Furbo 360 CVE-2025-11634

Requires direct physical access to the Furbo 360 or Furbo Mini camera hardware and the ability to open the device and connect to its on-board UART (serial) debug interface. The primary limiting factor is the Physical attack vector (AV:P) - the attack cannot be performed remotely or over the network and demands hands-on possession of the device. Affected firmware is Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074; no authentication is needed once physical UART access is obtained (PR:N), but no special software configuration is required, making the hardware interface itself the sole prerequisite.

This is a low-priority vulnerability by every available signal. The CVSS 4.0 vector (AV:P/AC:L/PR:N/UI:N/VC:L) scores just 2.4, driven down almost entirely by the Physical attack vector (AV:P) - an attacker must have hands-on possession of the device to connect to the UART interface. Impact is limited to low-confidentiality information disclosure (VC:L) with no integrity or availability impact. EPSS is 0.19% (8th percentile), consistent with the low practical exploitability of a physical-access-only flaw. The CVE is NOT in CISA KEV, so there is no evidence of active exploitation. The one elevating signal is that exploit code has been publicly released, but POC availability does not equal active exploitation and does little to raise real-world risk when physical access is the gating prerequisite. No SSVC decision data was provided in the input. All signals are internally consistent: a genuine but minor hardware-level information-disclosure issue in a consumer device, not an urgent remediation priority. Note the source is a single CNA (VulDB); the vendor did not respond to disclosure, so there is no independent vendor confirmation of affected versions or fix availability.

An attacker with physical possession of a Furbo 360 or Furbo Mini camera opens the casing, locates the exposed UART debug header on the circuit board, and attaches a serial adapter to read data disclosed over the interface. Public exploit code for this technique has been released. Because the attack requires physically handling the device, exploitation is realistically limited to scenarios such as second-hand/resold units, supply-chain interception, or an attacker with temporary physical access.