Furbo 360 and Furbo Mini CVE-2025-11644

Physical access to the UART interface on the device's printed circuit board is mandatory - the attacker must physically open the device housing, identify the UART pins, and connect a serial adapter (e.g., USB-to-UART cable). The vulnerability does not require authentication, network access, or user interaction once physical access is obtained. No special firmware configuration or enabled features are needed; the insecure storage exists in all deployed versions regardless of user settings. Exploitation is not feasible remotely, over the network, or without breaking the device's physical enclosure. The high attack complexity (AC:H) reflects the technical skill required to identify UART pins, avoid damaging components during disassembly, and parse firmware structures - but once accomplished, credential extraction is straightforward due to plaintext storage.

This vulnerability presents minimal real-world exploitation risk despite public exploit code availability. CVSS v4.0 score of 0.3 (vector: AV:P/AC:H) correctly reflects the severe practical barriers: physical proximity is mandatory (AV:P), attack complexity is high (AC:H), and impact is limited to confidentiality (VC:L). EPSS score of 0.02% (7th percentile) confirms very low likelihood of broad exploitation. The limiting factor is not patch availability but rather the prerequisite of direct physical access to the device - typical for consumer smart pet cameras in home environments where physical security is difficult for threat actors to overcome. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. Publicly available exploit code raises defensive awareness value but does not materially change risk posture given physical access requirement. This is classified as a localized insider threat or theft-after-compromise risk rather than a remote attack surface concern. Defenders should prioritize this below network-accessible or unauthenticated remote vulnerabilities.

An attacker gains physical access to a Furbo 360 or Furbo Mini camera (via theft, home break-in, or insider access) and connects a serial interface adapter to the UART debugging port on the device's PCB. Using publicly available exploit code from GitHub, the attacker reads the device firmware and extracts plaintext WiFi credentials and cloud authentication tokens. The attacker then uses these credentials to gain unauthorized access to the owner's WiFi network or cloud account to view live pet camera feeds, access stored video recordings, or pivot to other connected smart home devices.