Furbo 360 CVE-2025-11636

Exploitation targets the Furbo 360 Dog Camera's Account Handler component and requires crafting input that the server consumes to initiate an outbound request, redirecting it to an attacker-specified destination (SSRF). The primary limiting factor is the HIGH attack complexity (AC:H) - VulDB explicitly rates exploitability as 'difficult,' indicating success depends on non-trivial conditions (specific request formatting, timing, or bypass of input filtering) rather than a straightforward request. The supplied vector states no authentication is required (PR:N) and no user interaction (UI:N), but because the vulnerable component is the 'Account Handler,' defenders should verify whether a valid account or session is in fact needed, as this would materially raise the exploitation bar. Impact is inherently limited (low confidentiality/integrity/availability), so even successful SSRF likely yields constrained internal access rather than full device or backend takeover.

This is a genuinely moderate-risk issue that does not warrant emergency prioritization. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) describes a network-reachable flaw with HIGH attack complexity, and the vendor (via VulDB/VulDB's CNA cna@vuldb.com) explicitly rates exploitability as 'difficult' - a signal that strongly tempers the network attack vector. Impact is limited across the board (VC:L/VI:L/VA:L), consistent with SSRF (CWE-918) that typically yields limited internal reconnaissance or limited data exposure rather than full compromise. Corroborating signals point the same direction: EPSS is 0.40% (33rd percentile), there is NO CISA KEV listing, and no public exploit code is referenced - so there is no public exploit identified at time of analysis and no confirmed active exploitation. All signals are internally consistent (low EPSS + high AC + low impact + no KEV/POC), which raises confidence that this is a real-but-low-urgency finding rather than a high-CVSS/low-real-risk mismatch. One point to verify with the vendor: the affected component is the 'Account Handler,' which may imply an account/authentication context, yet the CVSS vector asserts PR:N (unauthenticated) - authentication requirements should be confirmed independently since the description alone does not resolve this.

A remote attacker crafts a malicious request to the Furbo 360 camera's cloud/device Account Handler, abusing a parameter that the server uses to make outbound requests, coercing the server into contacting an attacker-chosen internal or external endpoint (SSRF). Because the flaw carries high attack complexity and is rated 'difficult' to exploit, success likely depends on specific timing, encoding, or environmental conditions rather than a trivial single request. No public proof-of-concept exploit is identified at time of analysis.