Furbo 360 CVE-2025-11637

Exploitation requires the attacker to already hold low-privileged authenticated access to the Furbo 360 camera's audio-handling interface (CVSS PR:L) and to repeatedly trigger the audio handler to win a timing-dependent race window (CWE-362). Limiting factors: authentication is required (not an unauthenticated remote attacker), the impact is confined to low availability degradation of the audio component (VC:N/VI:N, VA:L) with no data exposure or code execution, and success depends on reliably winning a race condition. The specific audio-handler function and the exact feature or protocol path are not detailed in the available data.

This is a LOW-to-MODERATE real-world priority, not a high-urgency issue despite being remotely reachable. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) scores 5.3 (MEDIUM) and limits impact to LOW availability only - no confidentiality or integrity impact - which is consistent with a race condition (CWE-362) in an audio handler that would degrade or disrupt a service rather than disclose data or allow code execution. Signals are mostly aligned toward low risk: EPSS is 0.30% (21st percentile), there is NO CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or imminent exploitation. One conflict is worth flagging: the input Tags include 'Information Disclosure,' but the CVSS vector explicitly sets VC:N (no confidentiality impact) and only VA:L - the 'Information Disclosure' tag therefore appears inconsistent with the scored impact and should be verified rather than trusted. Note also that PR:L indicates the attacker must already be authenticated to the device, which meaningfully constrains exploitation. Because the vendor was contacted and did not respond, no patch is known to exist, so exposure persists until the vendor acts or the device is isolated.

An attacker who already has low-privileged authenticated access to a Furbo 360 camera (e.g., a valid app/account session or a user on the local/remote management path) sends concurrently timed requests to the audio handler to trigger the race condition, degrading or crashing the audio service. No public proof-of-concept exploit is identified at time of analysis, and the low-complexity rating in the input vector contrasts with the inherently timing-dependent nature of race conditions.