Furbo 360 CVE-2025-11638

Exploitation requires the attacker to be within the device's adjacent network or Bluetooth range (AV:A) and to interact with the Bluetooth Handler component of a vulnerable Furbo 360 (≤ FB0035_FW_036) or Furbo Mini (≤ MC0020_FW_074) camera; no authentication (PR:N) or user interaction (UI:N) is needed. The limiting factors are the required local proximity/network presence - this is not remotely exploitable over the internet - and the fact that impact is confined to denial of service (device unavailability) with no data exposure or code execution. Realistic risk is therefore bounded to attackers already on the same LAN or within Bluetooth range, such as on a shared home or guest network.

This is a genuinely low-priority issue despite a 'Medium' CVSS 4.0 base score of 5.3. All impact signals point to limited consequence: the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) shows an adjacent-network, low-complexity, unauthenticated attack, but the only impact metric set is VA:L (low availability impact) with VC:N and VI:N - no confidentiality or integrity loss, only a denial of service, consistent with CWE-404 (improper resource shutdown/release). EPSS is low at 0.34% (26th percentile), there is no CISA KEV listing, and no public proof-of-concept is referenced, so no public exploit is identified at time of analysis. The signals are internally consistent rather than conflicting: a low EPSS, no KEV, and DoS-only impact all agree this is not a mass-exploitation threat. The one point worth verifying is the attack vector framing - the description states the attacker 'needs to be present on the local network' and targets a 'Bluetooth Handler,' while the vector uses AV:A (adjacent); these are compatible, but a defender should confirm whether the exposure is via IP LAN, Bluetooth proximity, or both, since that changes the practical attacker-positioning requirement. The vendor was contacted and did not respond, so no fixed firmware is confirmed available.

An attacker with adjacent-network or Bluetooth-range access to a Furbo 360 or Furbo Mini camera sends manipulated input to the device's Bluetooth Handler, triggering improper resource handling that crashes or hangs the component and renders the camera's monitoring function unavailable. Exploitation requires no authentication or user interaction but does require local proximity/network presence. No public exploit code is identified at time of analysis.