Furbo 360 CVE-2025-11635

Requires valid low-privilege authenticated access (PR:L) to the Furbo 360 camera and the ability to reach its File Upload component, which can be exercised remotely over the network (AV:N). The attack abuses that upload path to trigger uncontrolled resource consumption. Limiting factors that reduce real-world risk: authentication is mandatory (not an unauthenticated flaw), impact is availability-only (no data disclosure or modification), and no patch is available because the vendor did not respond - exploitation also presumes the attacker can already reach and log into the device. Because the report originates from a single source (VulDB) with no vendor advisory, the precise configuration or upload feature involved is not detailed.

This is a low-to-moderate priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with a base score of 5.3 describes a remotely exploitable but authenticated (PR:L) denial-of-service affecting availability only (VA:L; VC:N/VI:N - no confidentiality or integrity impact). The EPSS score of 0.45% (37th percentile) is low, indicating no significant observed exploitation interest. The vulnerability is NOT in CISA KEV and has no public exploit code identified, so there is no evidence of active exploitation - the signals are internally consistent (low EPSS + no KEV + no POC + authentication requirement + DoS-only impact all point to limited real-world urgency). The required low-privilege authentication (PR:L) meaningfully constrains exploitation to actors who already possess valid device credentials or account access, which is a notable limiting factor. Key caveat: this is sourced solely from VulDB; there is no vendor advisory (the vendor was contacted but did not respond), so affected-version boundaries and the exact nature of the 'File Upload' feature are not independently confirmed.

An attacker who holds valid low-privilege credentials for a Furbo 360 camera sends a crafted request to the device's file-upload functionality, causing uncontrolled resource consumption (CWE-400). The camera's resources are exhausted, degrading or disrupting its availability (live video/monitoring). No public exploit code has been identified, and exploitation requires prior authentication, so the attack is not drive-by or unauthenticated.