Furbo 360 Dog Camera Firmware
Monthly
Weak cryptographic hash implementation in Tomofun Furbo 360 and Furbo Mini firmware allows local attackers with low privileges to compromise password security through use of insecure encryption algorithms in the password handler. The vulnerability affects Furbo 360 up to firmware version FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though real-world exploitation requires physical device access and high technical complexity.
A hard-coded root password in the Tomofun Furbo 360 and Furbo Mini pet cameras allows local attackers with low privileges to achieve full device compromise (confidentiality, integrity, and availability impact). Exploitation requires local access and high attack complexity, and a public proof-of-concept exists on GitHub. At the time of analysis, EPSS estimates a 0.02% probability of exploitation, and no active exploitation has been reported.
Server-side request forgery in Tomofun Furbo 360 and Furbo Mini dog cameras allows remote attackers to manipulate the TF_FQDN.json configuration file via the GATT Interface URL Handler, enabling arbitrary internal network requests with low confidentiality and integrity impact. Affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though the attack requires high complexity and is not actively exploited at scale per EPSS data (0.06%, percentile 18%).
Information disclosure vulnerability in Tomofun Furbo 360 and Furbo Mini dog cameras allows local network attackers to extract sensitive DeviceToken data via manipulation of GATT Service arguments. The attack requires high technical complexity and adjacency to the target network. Publicly available exploit code exists; however, the extremely low EPSS score (0.03%) and requirement for local network access and high attack complexity suggest limited real-world exploitation likelihood despite POC availability.
Improper access controls in the GATT Service of Tomofun Furbo 360 and Furbo Mini dog cameras allow local network attackers to disclose sensitive information without authentication. Affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though the low CVSS score of 2.1 and minimal EPSS (0.03%) reflect the local network-only attack vector and information disclosure impact.
Insecure storage of sensitive information in Tomofun Furbo 360 and Furbo Mini dog cameras via UART interface allows physical attackers to extract unencrypted credentials and private data from firmware versions Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vulnerability requires physical device access and high technical complexity but publicly available exploit code exists. Vendor did not respond to early disclosure notification.
Hard-coded MQTT client certificate credentials in Furbo 360 (up to FB0035_FW_036) and Furbo Mini (up to MC0020_FW_074) firmware allow an attacker who extracts the static secret from the /squashfs-root/furbo_img image to authenticate to the device MQTT service and tamper with communications, with only low integrity impact assessed. Attack complexity is high because the credential must first be recovered offline from firmware, and no authentication or user interaction is needed once it is obtained. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.28% (20th percentile).
Denial of service in Tomofun Furbo 360 and Furbo Mini pet cameras occurs through the Registration Handler when a physically present attacker with low-privilege authenticated access manipulates an unspecified function, causing availability loss (CWE-404). Exploitation requires direct physical access and is described as high-complexity/difficult, so remote or at-scale attacks are not feasible; EPSS is low (0.15%) and no public exploit has been identified at time of analysis. Affected firmware is Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074, and the vendor did not respond to disclosure.
Physical manipulation of the Trial Restriction Handler on Tomofun Furbo 360 (through firmware FB0035_FW_036) and Furbo Mini (through MC0020_FW_074) can improperly bypass access controls, with low confidentiality, integrity, and availability impact. The attack requires hands-on device access and is rated high complexity and difficult to exploit; no public exploit identified at time of analysis, and EPSS is 0.18% (8th percentile). This is a confirmed access-control weakness but a low-priority risk because it cannot be triggered remotely.
Cleartext transmission of sensitive information over Bluetooth Low Energy in Tomofun Furbo 360 and Furbo Mini firmware (Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074) gives an attacker within BLE radio range access to limited confidential data. The issue is rated CVSS 2.3 because exploitation requires adjacent proximity and is highly complex, and only confidentiality is affected. No public exploit identified at time of analysis, EPSS is 0.22% (11th percentile), and the vendor did not respond to the disclosure.
Insecure local storage in Tomofun Furbo 360 and Furbo Mini firmware lets authenticated local users with low privileges access sensitive information written by collect_logs.sh in the Debug Log S3 Bucket Handler before upload. The flaw affects Furbo 360 through FB0035_FW_036 and Furbo Mini through MC0020_FW_074; publicly available exploit code exists, but EPSS is low at 0.24% (13th percentile) and there is no CISA KEV confirmation of active exploitation. Impact is limited to low confidentiality disclosure, with no integrity or availability effect and no remote attack path.
Denial of service in Tomofun Furbo 360 and Furbo Mini cameras allows unauthenticated attackers on the adjacent network (Bluetooth range) to disrupt device availability via the Bluetooth Handler. The flaw stems from improper resource shutdown or release (CWE-404) and affects firmware versions up to FB0035_FW_036 (Furbo 360) and MC0020_FW_074 (Furbo Mini). No public exploit code has been identified at time of analysis, and EPSS is low at 0.34% (26th percentile); real-world risk is bounded to local proximity and limited availability impact.
A race condition in the audio handler of Tomofun's Furbo 360 dog camera firmware (through FB0035_FW_036) allows a remote attacker who already holds low-privileged authenticated access to repeatedly trigger the audio-handling routine and win a timing window, degrading audio availability. Impact is confined to low availability loss (C:N/I:N/A:L) with no data exposure, integrity impact, or code execution, and the attack requires both authentication and reliable race-condition timing, so real-world priority is low-to-moderate. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.30% (21st percentile), and the vendor did not respond to the disclosure.
Server-side request forgery in Tomofun's Furbo 360 dog camera firmware (builds up to FB0035_FW_036) lets remote, unauthenticated attackers manipulate the Account Handler component into issuing outbound requests to destinations of their choosing, potentially reaching internal network services or cloud metadata endpoints. The supplied CVSS vector carries PR:N and UI:N, so no credentials or user interaction are indicated, but both the provided CVSS 4.0 vector and our assessment rate attack complexity as High (AC:H) and VulDB describes exploitability as 'difficult,' meaning success hinges on non-trivial request crafting, timing, or filter bypass rather than a simple request. Impact is constrained (low confidentiality, integrity and availability); EPSS is only 0.40% (33rd percentile), no public exploit identified at time of analysis, and the vendor was contacted early but did not respond.
Resource exhaustion in the Tomofun Furbo 360 dog camera (firmware through FB0035_FW_036) lets a remote attacker with valid low-privilege credentials trigger uncontrolled resource consumption through the device's File Upload component, degrading availability. Exploitation requires the attacker to already reach the camera's upload interface over the network and to be authenticated, and impact is limited to availability with no confidentiality or integrity loss. No public exploit code and no confirmed active exploitation have been identified, and the EPSS score is low at 0.45% (37th percentile); the vendor was contacted about the issue but did not respond, so no patch is available.
Physical access to the UART debug interface on Tomofun Furbo 360 (firmware up to FB0035_FW_036) and Furbo Mini (up to MC0020_FW_074) allows an attacker with hands-on possession of the device to disclose sensitive information from the camera. The flaw is a CWE-200 information exposure issue rated CVSS 2.4 (CVSS 4.0 AV:P), and publicly available exploit code exists; EPSS is 0.19% (8th percentile), consistent with a low-risk, physical-only attack. No authentication is required once UART access is obtained, but the attack cannot be performed remotely.
Tomofun Furbo 360 and Furbo Mini dog cameras running firmware up to FB0035_FW_036 and MC0020_FW_074 do not properly validate TLS certificates when collect_logs.sh invokes upload_file_to_s3 for Amazon S3 log uploads, letting an attacker who already holds a man-in-the-middle position intercept or tamper with log data. Exploitation is remote but high-complexity and described as difficult, with no public exploit identified at time of analysis and a low EPSS score of 0.26% (17th percentile). The vendor was contacted but did not respond, so no official patch is available.
Weak cryptographic hash implementation in Tomofun Furbo 360 and Furbo Mini firmware allows local attackers with low privileges to compromise password security through use of insecure encryption algorithms in the password handler. The vulnerability affects Furbo 360 up to firmware version FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though real-world exploitation requires physical device access and high technical complexity.
A hard-coded root password in the Tomofun Furbo 360 and Furbo Mini pet cameras allows local attackers with low privileges to achieve full device compromise (confidentiality, integrity, and availability impact). Exploitation requires local access and high attack complexity, and a public proof-of-concept exists on GitHub. At the time of analysis, EPSS estimates a 0.02% probability of exploitation, and no active exploitation has been reported.
Server-side request forgery in Tomofun Furbo 360 and Furbo Mini dog cameras allows remote attackers to manipulate the TF_FQDN.json configuration file via the GATT Interface URL Handler, enabling arbitrary internal network requests with low confidentiality and integrity impact. Affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though the attack requires high complexity and is not actively exploited at scale per EPSS data (0.06%, percentile 18%).
Information disclosure vulnerability in Tomofun Furbo 360 and Furbo Mini dog cameras allows local network attackers to extract sensitive DeviceToken data via manipulation of GATT Service arguments. The attack requires high technical complexity and adjacency to the target network. Publicly available exploit code exists; however, the extremely low EPSS score (0.03%) and requirement for local network access and high attack complexity suggest limited real-world exploitation likelihood despite POC availability.
Improper access controls in the GATT Service of Tomofun Furbo 360 and Furbo Mini dog cameras allow local network attackers to disclose sensitive information without authentication. Affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though the low CVSS score of 2.1 and minimal EPSS (0.03%) reflect the local network-only attack vector and information disclosure impact.
Insecure storage of sensitive information in Tomofun Furbo 360 and Furbo Mini dog cameras via UART interface allows physical attackers to extract unencrypted credentials and private data from firmware versions Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vulnerability requires physical device access and high technical complexity but publicly available exploit code exists. Vendor did not respond to early disclosure notification.
Hard-coded MQTT client certificate credentials in Furbo 360 (up to FB0035_FW_036) and Furbo Mini (up to MC0020_FW_074) firmware allow an attacker who extracts the static secret from the /squashfs-root/furbo_img image to authenticate to the device MQTT service and tamper with communications, with only low integrity impact assessed. Attack complexity is high because the credential must first be recovered offline from firmware, and no authentication or user interaction is needed once it is obtained. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.28% (20th percentile).
Denial of service in Tomofun Furbo 360 and Furbo Mini pet cameras occurs through the Registration Handler when a physically present attacker with low-privilege authenticated access manipulates an unspecified function, causing availability loss (CWE-404). Exploitation requires direct physical access and is described as high-complexity/difficult, so remote or at-scale attacks are not feasible; EPSS is low (0.15%) and no public exploit has been identified at time of analysis. Affected firmware is Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074, and the vendor did not respond to disclosure.
Physical manipulation of the Trial Restriction Handler on Tomofun Furbo 360 (through firmware FB0035_FW_036) and Furbo Mini (through MC0020_FW_074) can improperly bypass access controls, with low confidentiality, integrity, and availability impact. The attack requires hands-on device access and is rated high complexity and difficult to exploit; no public exploit identified at time of analysis, and EPSS is 0.18% (8th percentile). This is a confirmed access-control weakness but a low-priority risk because it cannot be triggered remotely.
Cleartext transmission of sensitive information over Bluetooth Low Energy in Tomofun Furbo 360 and Furbo Mini firmware (Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074) gives an attacker within BLE radio range access to limited confidential data. The issue is rated CVSS 2.3 because exploitation requires adjacent proximity and is highly complex, and only confidentiality is affected. No public exploit identified at time of analysis, EPSS is 0.22% (11th percentile), and the vendor did not respond to the disclosure.
Insecure local storage in Tomofun Furbo 360 and Furbo Mini firmware lets authenticated local users with low privileges access sensitive information written by collect_logs.sh in the Debug Log S3 Bucket Handler before upload. The flaw affects Furbo 360 through FB0035_FW_036 and Furbo Mini through MC0020_FW_074; publicly available exploit code exists, but EPSS is low at 0.24% (13th percentile) and there is no CISA KEV confirmation of active exploitation. Impact is limited to low confidentiality disclosure, with no integrity or availability effect and no remote attack path.
Denial of service in Tomofun Furbo 360 and Furbo Mini cameras allows unauthenticated attackers on the adjacent network (Bluetooth range) to disrupt device availability via the Bluetooth Handler. The flaw stems from improper resource shutdown or release (CWE-404) and affects firmware versions up to FB0035_FW_036 (Furbo 360) and MC0020_FW_074 (Furbo Mini). No public exploit code has been identified at time of analysis, and EPSS is low at 0.34% (26th percentile); real-world risk is bounded to local proximity and limited availability impact.
A race condition in the audio handler of Tomofun's Furbo 360 dog camera firmware (through FB0035_FW_036) allows a remote attacker who already holds low-privileged authenticated access to repeatedly trigger the audio-handling routine and win a timing window, degrading audio availability. Impact is confined to low availability loss (C:N/I:N/A:L) with no data exposure, integrity impact, or code execution, and the attack requires both authentication and reliable race-condition timing, so real-world priority is low-to-moderate. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.30% (21st percentile), and the vendor did not respond to the disclosure.
Server-side request forgery in Tomofun's Furbo 360 dog camera firmware (builds up to FB0035_FW_036) lets remote, unauthenticated attackers manipulate the Account Handler component into issuing outbound requests to destinations of their choosing, potentially reaching internal network services or cloud metadata endpoints. The supplied CVSS vector carries PR:N and UI:N, so no credentials or user interaction are indicated, but both the provided CVSS 4.0 vector and our assessment rate attack complexity as High (AC:H) and VulDB describes exploitability as 'difficult,' meaning success hinges on non-trivial request crafting, timing, or filter bypass rather than a simple request. Impact is constrained (low confidentiality, integrity and availability); EPSS is only 0.40% (33rd percentile), no public exploit identified at time of analysis, and the vendor was contacted early but did not respond.
Resource exhaustion in the Tomofun Furbo 360 dog camera (firmware through FB0035_FW_036) lets a remote attacker with valid low-privilege credentials trigger uncontrolled resource consumption through the device's File Upload component, degrading availability. Exploitation requires the attacker to already reach the camera's upload interface over the network and to be authenticated, and impact is limited to availability with no confidentiality or integrity loss. No public exploit code and no confirmed active exploitation have been identified, and the EPSS score is low at 0.45% (37th percentile); the vendor was contacted about the issue but did not respond, so no patch is available.
Physical access to the UART debug interface on Tomofun Furbo 360 (firmware up to FB0035_FW_036) and Furbo Mini (up to MC0020_FW_074) allows an attacker with hands-on possession of the device to disclose sensitive information from the camera. The flaw is a CWE-200 information exposure issue rated CVSS 2.4 (CVSS 4.0 AV:P), and publicly available exploit code exists; EPSS is 0.19% (8th percentile), consistent with a low-risk, physical-only attack. No authentication is required once UART access is obtained, but the attack cannot be performed remotely.
Tomofun Furbo 360 and Furbo Mini dog cameras running firmware up to FB0035_FW_036 and MC0020_FW_074 do not properly validate TLS certificates when collect_logs.sh invokes upload_file_to_s3 for Amazon S3 log uploads, letting an attacker who already holds a man-in-the-middle position intercept or tamper with log data. Exploitation is remote but high-complexity and described as difficult, with no public exploit identified at time of analysis and a low EPSS score of 0.26% (17th percentile). The vendor was contacted but did not respond, so no official patch is available.