Tomofun Furbo 360 and Furbo Mini CVE-2025-11650

Attack requires physical access to the device hardware (AV:P confirms this is not remotely exploitable). Attacker must have low-level authentication (PR:L) or ability to extract firmware directly from the device. The attack is limited to scenarios where an adversary can physically touch the device, connect debugging interfaces, or extract and analyze the firmware offline. Exploitation is not possible against default remote configurations; it strictly requires hands-on device access combined with technical reverse-engineering capability to leverage the weak hashing algorithm. Default network deployments are not affected unless the attacker first gains physical access to the specific device.

This vulnerability presents minimal real-world risk despite public exploit availability. The CVSS v4.0 score of 0.3 with physical attack vector (AV:P), high complexity (AC:H), and low integrity impact reflects multiple limiting factors: the attack requires direct physical access to the device, authenticated access (PR:L), and high technical sophistication. EPSS scoring of 0.01% (1st percentile) further confirms negligible exploitation probability in the broader threat landscape. The KEV status is not confirmed in the provided data, and while a POC exists on GitHub, the combination of physical-only access requirement, authentication prerequisite, and low impact creates a narrow attack window. The primary concern is not widespread remote compromise but rather targeted attacks against devices already physically compromised or in environments where attackers have local presence. For most organizations and consumers, this ranks low on remediation priority compared to remotely exploitable vulnerabilities.

An attacker with physical access to a Furbo 360 or Furbo Mini device extracts the firmware or directly accesses the /etc/shadow file via UART/JTAG debug interfaces or physical device disassembly. Using the publicly disclosed GitHub POC, they analyze the weak hashing algorithm and perform offline password cracking or rainbow table lookup to recover device credentials. Once credentials are compromised, the attacker can gain authenticated access to device settings and potentially pivot to the home network if the device has network connectivity.