Furbo 360 CVE-2025-11639

Exploitation requires local access to the device with at least low-level privileges (CVSS PR:L), and depends on the debug-logging workflow implemented by collect_logs.sh in the Debug Log S3 Bucket Handler, which writes sensitive information to insecure local storage prior to S3 upload. Limiting factors: there is no remote attack path (AV:L), no user interaction is involved, impact is confined to low-severity confidentiality disclosure (VC:L, no integrity or availability effect), and only Furbo 360 firmware up to FB0035_FW_036 and Furbo Mini firmware up to MC0020_FW_074 are reported affected. The need for pre-existing local, authenticated access to a consumer camera substantially constrains realistic exploitation.

This is a genuinely low-to-moderate risk issue despite publicly available exploit code. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) describes local, low-privilege exploitation with only low confidentiality impact (VC:L) and no integrity or availability impact, yielding a modest 4.8 (Medium) score. EPSS reinforces this: 0.24% probability at the 13th percentile indicates very low likelihood of mass exploitation. The vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation - publicly available exploit code exists but POC availability must not be conflated with in-the-wild use. The SSVC-relevant signals align consistently here: local attack vector, low technical impact, and no automatability all point to a targeted, low-urgency issue rather than a widespread threat. One notable gap: the vendor (Tomofun) was contacted but did not respond, so there is no vendor-confirmed patch or advisory, and affected version boundaries rest solely on the researcher (VulDB/cna@vuldb.com) submission. The combination of local access requirement, consumer-IoT target, and low EPSS strongly suggests this is a low-priority issue for most defenders, meaningful mainly to individuals with physical or local access to the specific devices.

An attacker with local, low-privilege access to a Furbo 360 or Furbo Mini device (for example, a compromised companion process or local shell) reads the debug-log collection output produced by collect_logs.sh, which stores sensitive information insecurely before uploading to an S3 bucket. Publicly available exploit code exists, lowering the effort needed to extract the exposed data. Because exploitation is local and yields only limited confidentiality disclosure, impact is confined to information the attacker can already partly reach.