Furbo 360 and Furbo Mini CVE-2025-11644
LOWSeverity by source
CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Executing manipulation can lead to insecure storage of sensitive information. The physical device can be targeted for the attack. This attack is characterized by high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Insecure storage of sensitive information in Tomofun Furbo 360 and Furbo Mini dog cameras via UART interface allows physical attackers to extract unencrypted credentials and private data from firmware versions Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vulnerability requires physical device access and high technical complexity but publicly available exploit code exists. Vendor did not respond to early disclosure notification.
Technical ContextAI
The vulnerability exists in the UART (Universal Asynchronous Receiver-Transmitter) interface of Furbo pet cameras, a physical debug port typically used for firmware development and troubleshooting. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - sensitive data such as WiFi credentials, cloud API tokens, or user identifiers are stored in plaintext or with weak protection in the firmware accessible via UART. An attacker with direct physical access to the device can connect via serial interface to read memory, extract credentials, or manipulate flash storage. The affected products include Furbo 360 dog camera (firmware identifiers FB0035_FW_036 and earlier) and Furbo Mini (firmware identifiers MC0020_FW_074 and earlier), as identified by their respective CPE strings.
RemediationAI
Upgrade Furbo 360 to firmware version FB0035_FW_037 or later and Furbo Mini to firmware version MC0020_FW_075 or later when available from Tomofun. Since vendor communication has been unresponsive, no official patch timeline is confirmed; users should monitor Tomofun's support portal and firmware update mechanisms for new releases. As a compensating control for environments where UART access is a genuine concern, physically secure devices to prevent unauthorized debug port access - this includes storing pet cameras in locked cabinets or restricting physical device access to trusted household members only. If firmware updates remain unavailable, disable remote access features and cloud connectivity if operationally acceptable to reduce secondary impact from compromised credentials. Users should assume that any device of this model with firmware version at or below the listed thresholds may have credentials stored insecurely and should rotate WiFi passwords and cloud API tokens used by these devices as a precautionary measure.
Share
External POC / Exploit Code
Leaving vuln.today