Furbo 360 and Furbo Mini CVE-2025-11648

CRITICAL CONDITION: Attacker must establish a Bluetooth Low Energy (BLE) connection to the target Furbo device. This requires the device to be in a pairable state (not all devices default to this) and the attacker to be in BLE radio range (typically 10-100 meters depending on environment). The attack targets the GATT Interface URL Handler component, specifically the TF_FQDN.json configuration file stored or processed by the device. BLE pairing may require user interaction (e.g., camera in setup mode or pairing enabled) depending on the device configuration, though the description does not explicitly mandate this. The CVSS vector AC:H indicates high attack complexity, reflecting that successful exploitation requires precise knowledge of the BLE protocol, correct GATT service UUID/characteristic discovery, and proper JSON payload structure. No authentication credentials are required once BLE pairing is established (PR:N). The vulnerability does NOT require network-layer compromise; it operates entirely over BLE, making it accessible to any attacker within physical/radio range of the device.

Risk is LOW in aggregate despite publicly available exploit code. CVSS v4.0 score of 2.9 with AC:H (high complexity) and limited scope (VC:L/VI:L/VA:L - low confidentiality, integrity, availability impact) accurately reflects the attack difficulty. EPSS score of 0.06% (18th percentile) confirms minimal real-world exploitation probability, suggesting this remains a niche technical vulnerability without widespread active exploitation. Attack vector is network (AV:N) and unauthenticated (PR:N), but the high attack complexity, requirement for BLE proximity to pair with the device, and manipulation of a configuration file that must be parsed correctly significantly increase the barrier to exploitation. Vendor non-response (unpatched for extended period) elevates concern from a supply-chain perspective, but the low CVSS impact scores and lack of KEV/active-in-the-wild signals indicate this is not an immediate critical threat to most deployments. Risk is primarily relevant to owners of these specific pet cameras who may be targeted by sophisticated attackers with physical or network proximity.

An attacker within Bluetooth range (typically 30-100 meters for BLE) pairs with an unpatched Furbo 360 or Mini camera and sends a crafted BLE payload to modify the TF_FQDN.json file, injecting a malicious URL. When the device attempts to reach its backend services or check for firmware updates, it instead connects to an attacker-controlled server, leaking device identifiers, account tokens, or other sensitive data. Alternatively, the attacker could redirect requests to internal network services (e.g., 192.168.1.x API endpoints) to gather intelligence on the home network.