Furbo 360 CVE-2025-11640

Exploitation requires the attacker to be within Bluetooth Low Energy radio range of the target Furbo 360 or Furbo Mini device (AV:A, adjacent access) and to interact with the device's BLE interface while sensitive data is transmitted in cleartext. Exploitation is strongly limited by high attack complexity (AC:H) - the reporter explicitly states exploitability is 'difficult' - which implies dependence on specific timing, device state, or pairing conditions rather than a trivially repeatable attack. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the physical-proximity requirement and high complexity substantially constrain realistic exploitation. Only limited confidentiality is at stake (VC:L); integrity and availability are unaffected.

This is a low-priority, low-real-risk issue despite being a genuine confirmed weakness. All signals align toward minimal risk: the CVSS 4.0 base score is 2.3 (LOW), the EPSS exploitation probability is only 0.22% (11th percentile), there is no CISA KEV listing, and no public exploit code was identified. The CVSS 4.0 vector itself describes a constrained attack - AV:A means the attacker must be within Bluetooth/adjacent-network range, AC:H reflects high attack complexity (the reporter explicitly calls exploitation 'difficult'), and the only impact is VC:L (low confidentiality) with no integrity or availability impact. The weakness (CWE-310/cleartext transmission over Bluetooth Low Energy) is real but yields only limited information disclosure to a physically proximate attacker. No signals conflict - every data source (CVSS, EPSS, absent KEV, absent POC) consistently indicates this is a theoretical, low-severity local-proximity issue rather than an actively exploited or widespread threat. One caveat: the vendor (Tomofun) did not respond to disclosure, so there is no confirmed fix, and the analysis rests solely on the VulDB CNA submission.

An attacker within Bluetooth Low Energy radio range of a Furbo 360 or Furbo Mini camera passively intercepts or actively probes the BLE communication and recovers sensitive information transmitted in cleartext. Because the CVSS vector reports high attack complexity and the reporter rates exploitability as 'difficult,' success likely requires favorable timing or specific device states. No public exploit code was identified at time of analysis.