Furbo 360 CVE-2025-11633

Exploitation requires the attacker to hold an active man-in-the-middle position on the network path between the Furbo device and Amazon S3, so that when the HTTP Traffic Handler invokes upload_file_to_s3 in collect_logs.sh the attacker can supply a forged/invalid TLS certificate that the device fails to reject. Limiting factors: the attack is explicitly high-complexity and 'known to be difficult,' it only affects the device's outbound log-upload channel (not arbitrary device functions), impact is confined to interception/tampering of log data, and it is bounded to the named firmware (Furbo 360 ≤ FB0035_FW_036 and Furbo Mini ≤ MC0020_FW_074). No authentication is required (PR:N) and no user interaction is needed, but the required privileged network position is the dominant real-world constraint.

This is a genuinely low-priority issue despite a moderate 6.3 CVSS 4.0 score. The vector (AV:N/AC:H/PR:N/UI:N) is network-reachable and unauthenticated, but AC:H plus the vendor-assessed impact of integrity-only-low (VI:L, with VC:N and VA:N) places a hard ceiling on consequences - there is no code execution, no data-at-rest compromise, and no availability impact. The flaw is improper certificate validation (CWE-287 as tagged) in the device's outbound log-upload-to-S3 path, which is realistically exploitable only by an attacker already holding a man-in-the-middle position on the network path, consistent with the description's explicit statements that the attack is 'high complexity' and 'known to be difficult.' All exploitation signals agree on low urgency: EPSS is 0.26% (17th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. No SSVC decision data was supplied. The only mild tension is that AV:N suggests remote reach while the underlying cert-validation weakness in practice needs an adversary-in-the-middle position to be meaningful - this is not a contradiction but it means raw 'network' reachability overstates practical exposure. Net: a real but minor finding, not an operational emergency.

An attacker who can intercept the camera's network traffic (e.g., a compromised Wi-Fi network, rogue access point, or upstream MITM position) presents a forged TLS certificate when the device runs collect_logs.sh to upload logs to S3. Because upload_file_to_s3 does not properly validate the certificate, the attacker can intercept or tamper with the transmitted log data. No public exploit code was identified at time of analysis, and exploitation requires the attacker to already occupy a privileged network position, consistent with the described high attack complexity.