Furbo 360 and Furbo Mini CVE-2025-11647

Exploitation requires the attacker to be on the same local network (adjacent network) as the target Furbo camera. The device must have Bluetooth enabled and discoverable (default configuration for functionality). The attacker must possess detailed knowledge of the BLE GATT service structure and crafting techniques to manipulate the DeviceToken argument-this is not trivial reconnaissance and explains the high attack complexity (AC:H) rating. No authentication is required from the camera's perspective (PR:N), as BLE discovery and GATT service enumeration are typically unauthenticated on consumer IoT devices. The attack does not require user interaction (UI:N). Limiting factors include: (1) requirement for local/adjacent network access, eliminating remote exploitation; (2) high attack complexity necessitating specialized BLE exploitation skills; (3) no widespread tooling or low-skill exploits publicly available despite POC existence; (4) limited impact scope (confidentiality only, no integrity or availability impact).

This vulnerability presents a low real-world risk despite its straightforward nature. The CVSS 4.0 score of 1.3 reflects the significant barriers to exploitation: adjacent attack vector (AV:A, not network), high attack complexity (AC:H), and low confidentiality impact (VC:L). The EPSS score of 0.03% (9th percentile) indicates minimal exploitation probability in the wild, suggesting this is not a widespread concern despite POC availability. The attack requires specific conditions-local network proximity, high technical skill, and detailed knowledge of BLE GATT internals. However, the vendor's lack of response (no patched firmware versions available) means affected devices remain permanently vulnerable. Risk is contextual: homes with Furbo cameras on isolated IoT networks face minimal threat; however, corporate or shared network environments where an attacker can achieve local network access would have elevated risk. The divergence between POC availability (publicly available) and EPSS exploitation probability (0.03%) suggests the POC is technically competent but requires sufficient expertise to weaponize that most attackers lack.

An attacker on the same local network as a Furbo 360 or Mini camera (e.g., a guest on the home WiFi or compromised IoT device on the network) discovers the target camera via BLE scanning. The attacker uses publicly available exploit code from the GitHub advisory to craft a malicious GATT Service request that manipulates the DeviceToken argument, causing the camera to leak the token. The attacker extracts the DeviceToken, potentially enabling unauthorized access to the device's cloud services or remote control features depending on how the token is used by the Furbo mobile application.