Furbo 360 CVE-2025-11643

Exploitation requires the attacker to first acquire and unpack the device firmware image (/squashfs-root/furbo_img) to extract the static, hard-coded MQTT client certificate credential - the credential is not exposed over the network by default and must be recovered offline from firmware, which is the primary limiting factor and the basis for the AC:H rating. It affects Furbo 360 firmware up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. No authentication or user interaction is needed once the credential is obtained (PR:N/UI:N), but practical exploitation is gated by the firmware-reverse-engineering prerequisite and the limited integrity-only impact.

This is a high-CVSS-adjacent but genuinely low-real-risk issue. The CVSS 4.0 base score is 6.3 (Medium), driven by network reachability (AV:N, PR:N, UI:N) but heavily tempered by high attack complexity (AC:H) and an impact limited to low integrity only (VI:L; VC:N, VA:N) - meaning no confidentiality or availability loss. The reporter (VulDB) and the description both explicitly state exploitation 'appears to be difficult,' which aligns with AC:H. EPSS reinforces the low-urgency picture: 0.28% probability at only the 20th percentile. There is no CISA KEV listing and no public exploit code identified, so there is no evidence of active or imminent exploitation. The key friction is that the 'network' vector is somewhat misleading: the hard-coded credential lives in the MQTT client certificate embedded in the firmware image (/squashfs-root/furbo_img), so an attacker must first obtain and reverse-engineer device firmware to extract the credential before any remote use - this is why complexity is high. Net assessment: low operational priority; a real but hard-to-weaponize flaw in a consumer IoT device, not a widespread enterprise emergency. Note the unresolved vendor situation - Tomofun did not respond to disclosure, so no official patch is confirmed.

An attacker obtains Furbo camera firmware (via download or device extraction), unpacks the squashfs image, and recovers the hard-coded MQTT client certificate credential shared across devices. Because the credential is static and embedded, the attacker could reuse it to interact with the MQTT backend and tamper with message integrity. No public exploit code exists, and the high attack complexity (firmware extraction and analysis required) makes opportunistic mass exploitation unlikely.