Tomofun Furbo 360 and Furbo Mini CVE-2025-11646

Attacker must be located on the same local network segment as the Furbo device and within Bluetooth range (typically 10-100 meters depending on environment and device class). The device must have Bluetooth enabled, which is the default configuration. No authentication credentials, user interaction, or special firmware configuration is required to trigger the vulnerability - the GATT Service responds to unauthenticated queries. Exploitation is limited by: (1) proximity requirement - attacker cannot exploit from internet or across network NAT boundaries; (2) Bluetooth range limitations; (3) the device must be powered on and advertising its GATT Service. Default configurations of Furbo 360 and Furbo Mini are vulnerable without any user-initiated changes.

The risk profile is low despite public exploit availability, supported by multiple converging signals. The CVSS 4.0 score of 2.1 reflects a critical limiting factor: AV:A (adjacent network required), meaning an attacker must be on the same local network segment as the device - this is not internet-facing. The CVSS vector shows low impact across all confidentiality, integrity, and availability dimensions (VC:L/VI:L/VA:L, with SI:N and SA:N). Most significantly, the EPSS score of 0.03% at percentile 8% indicates minimal real-world exploitation probability despite public POC availability, suggesting either narrow applicability, low value target set, or significant practical barriers not captured in the CVSS static score. The lack of CISA KEV listing despite public exploit code further indicates limited autonomous exploitation potential. CWE-266 typically enables privilege escalation or lateral movement, but here the impact is limited to local information disclosure. For organizations, this is a low-priority patch unless the local network perimeter is highly contested or the disclosed information (P2P UUID) enables secondary attacks.

An attacker on the same local Wi-Fi network as a Furbo 360 or Furbo Mini camera uses a Bluetooth scanning tool to discover the device and connect via BLE. Without requiring any authentication, the attacker queries the GATT Service and extracts the device's P2P UUID, which identifies the device in Tomofun's peer-to-peer infrastructure. This UUID could be used to gather intelligence on the device's network topology, potentially enabling secondary attacks on the owner's network or cross-device targeting within the Furbo ecosystem.