CVE-2025-11644

Опубликовано: 12 окт. 2025

Источник: nvd

CVSS3: 2

CVSS3: 4.2

CVSS2: 1.2

EPSS Низкий

Описание

A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Executing manipulation can lead to insecure storage of sensitive information. The physical device can be targeted for the attack. This attack is characterized by high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.

Ссылки

https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure%20Storage%20of%20Sensitve%20Information%20-%20CVE-2025-XXXX.md
Exploit
Third Party Advisory
https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure%20Storage%20of%20Sensitve%20Information%20-%20CVE-2025-XXXXX.md
Exploit
Third Party Advisory
https://vuldb.com/?ctiid.328055
Permissions Required
VDB Entry
https://vuldb.com/?id.328055
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.661878
Third Party Advisory
VDB Entry
https://vuldb.com/?submit.661879
Third Party Advisory
VDB Entry
https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure%20Storage%20of%20Sensitve%20Information%20-%20CVE-2025-XXXX.md
Exploit
Third Party Advisory
https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure%20Storage%20of%20Sensitve%20Information%20-%20CVE-2025-XXXXX.md
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:furbo:furbo_mini_firmware:*:*:*:*:*:*:*:*

Версия до 074 (включая)

cpe:2.3:h:furbo:furbo_mini:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:furbo:furbo_360_dog_camera_firmware:*:*:*:*:*:*:*:*

Версия до 036 (включая)

cpe:2.3:h:furbo:furbo_360_dog_camera:*:*:*:*:*:*:*:*

EPSS

Процентиль: 8%

0.00029

Низкий

2 Low

CVSS3

4.2 Medium

CVSS3

1.2 Low

CVSS2

Дефекты

CWE-200

CWE-922

Связанные уязвимости

GHSA-w576-942q-hcrp

CVSS3: 2

github

4 месяца назад

A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Executing manipulation can lead to insecure storage of sensitive information. The physical device can be targeted for the attack. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be exploited. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.

EPSS

Процентиль: 8%

0.00029

Низкий

2 Low

CVSS3

4.2 Medium

CVSS3

1.2 Low

CVSS2

Дефекты

CWE-200

CWE-922