Furbo 360 CVE-2025-11642

Exploitation requires direct physical access to a Furbo 360 or Furbo Mini camera (AV:P) plus low-privilege authentication (PR:L), and the attack is explicitly described as high-complexity and 'difficult' (AC:H). The flaw is reached through the device's Registration Handler and yields only denial of service (availability loss), not data exposure. Limiting factors: the attacker must physically possess or be at the device, hold some authenticated access, and overcome significant complexity - ruling out any remote or at-scale exploitation. Affected firmware is Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074; newer firmware is presumed unaffected but unconfirmed by the vendor.

This is a low-priority issue despite its CRITICAL-sounding denial-of-service outcome. The CVSS 4.0 vector (AV:P/AC:H/AT:N/PR:L/UI:N) and the resulting base score of 4.1 (MEDIUM) all point the same direction: exploitation requires PHYSICAL access to the device (AV:P), a HIGH level of attack complexity (AC:H), and at least low-privilege authentication (PR:L). The description independently reinforces this, stating the attack 'can be executed directly on the physical device' and that 'exploitability is told to be difficult.' Impact is limited strictly to availability (VA:H; VC:N/VI:N) - there is no confidentiality or integrity exposure, consistent with CWE-404 (Improper Resource Shutdown/Release). The EPSS score of 0.15% (4th percentile) agrees with the low practical threat, as physically-local, high-complexity bugs are rarely exploited at scale. There is no CISA KEV listing and no public exploit code. All signals are mutually consistent here - there is no network vector contradicting the description, and no KEV/EPSS conflict. The only notable gap is sourcing: this is a single-source VulDB disclosure with no vendor corroboration (the vendor did not respond), so affected-version and component details are not independently confirmed.

An attacker with temporary physical possession of a Furbo 360 or Furbo Mini camera and low-privilege access interacts with the device's Registration Handler, supplying manipulated input that improperly releases or exhausts a resource and crashes the device into a denial-of-service state. Because the vector is physical and complexity is high, this is realistically limited to someone who already has hands-on access to the unit (e.g., a returned, resold, or stolen device). No public exploit code has been identified at time of analysis.