Furbo 360 CVE-2025-11641

Requires physical possession of and hands-on interaction with the affected Furbo 360 (firmware up to FB0035_FW_036) or Furbo Mini (firmware up to MC0020_FW_074) device to manipulate the Trial Restriction Handler component. Limiting factors are significant: the attack vector is Physical (AV:P), attack complexity is High and exploitability is explicitly described as difficult, meaning no remote or network-based exploitation is possible and the attacker must defeat a non-trivial technique on the device itself. No authentication is required (PR:N) once physical access is obtained, and impact is limited to low confidentiality, integrity, and availability effects consistent with a trial/privilege-restriction bypass (CWE-266).

This is a low-priority issue despite being a confirmed access-control weakness. Every available signal points the same direction: the CVSS 4.0 vector (AV:P/AC:H/PR:N/UI:N with only Low VC/VI/VA) yields a base score of 1.0, meaning exploitation requires PHYSICAL access to the device, has HIGH attack complexity, and produces only limited confidentiality/integrity/availability impact. EPSS reinforces this with a 0.18% exploitation probability (8th percentile). There is no CISA KEV listing and no public exploit code, so this is not actively exploited. The only mild tension is that PR:N (no privileges required) could suggest easy access, but it is fully offset by AV:P plus AC:H - an attacker must already be holding the physical camera and overcome a difficult, non-trivial technique. The vendor (Tomofun) was contacted but did not respond, so no official advisory or patch is confirmed. Net assessment: a genuine but very low real-world risk, essentially a local trial/subscription-restriction bypass rather than a remotely exploitable threat.

An attacker with physical possession of a Furbo 360 or Furbo Mini camera manipulates the Trial Restriction Handler to bypass intended access controls (e.g., unlocking trial-gated features or subscription restrictions). The attack is rated high-complexity and difficult, and no public exploit code exists, so successful exploitation requires significant skill and hands-on access to the specific affected firmware.