Furbo Mini Firmware
Monthly
Weak cryptographic hash implementation in Tomofun Furbo 360 and Furbo Mini firmware allows local attackers with low privileges to compromise password security through use of insecure encryption algorithms in the password handler. The vulnerability affects Furbo 360 up to firmware version FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though real-world exploitation requires physical device access and high technical complexity.
A hard-coded root password in the Tomofun Furbo 360 and Furbo Mini pet cameras allows local attackers with low privileges to achieve full device compromise (confidentiality, integrity, and availability impact). Exploitation requires local access and high attack complexity, and a public proof-of-concept exists on GitHub. At the time of analysis, EPSS estimates a 0.02% probability of exploitation, and no active exploitation has been reported.
Server-side request forgery in Tomofun Furbo 360 and Furbo Mini dog cameras allows remote attackers to manipulate the TF_FQDN.json configuration file via the GATT Interface URL Handler, enabling arbitrary internal network requests with low confidentiality and integrity impact. Affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though the attack requires high complexity and is not actively exploited at scale per EPSS data (0.06%, percentile 18%).
Information disclosure vulnerability in Tomofun Furbo 360 and Furbo Mini dog cameras allows local network attackers to extract sensitive DeviceToken data via manipulation of GATT Service arguments. The attack requires high technical complexity and adjacency to the target network. Publicly available exploit code exists; however, the extremely low EPSS score (0.03%) and requirement for local network access and high attack complexity suggest limited real-world exploitation likelihood despite POC availability.
Improper access controls in the GATT Service of Tomofun Furbo 360 and Furbo Mini dog cameras allow local network attackers to disclose sensitive information without authentication. Affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though the low CVSS score of 2.1 and minimal EPSS (0.03%) reflect the local network-only attack vector and information disclosure impact.
Insecure storage of sensitive information in Tomofun Furbo 360 and Furbo Mini dog cameras via UART interface allows physical attackers to extract unencrypted credentials and private data from firmware versions Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vulnerability requires physical device access and high technical complexity but publicly available exploit code exists. Vendor did not respond to early disclosure notification.
Hard-coded MQTT client certificate credentials in Furbo 360 (up to FB0035_FW_036) and Furbo Mini (up to MC0020_FW_074) firmware allow an attacker who extracts the static secret from the /squashfs-root/furbo_img image to authenticate to the device MQTT service and tamper with communications, with only low integrity impact assessed. Attack complexity is high because the credential must first be recovered offline from firmware, and no authentication or user interaction is needed once it is obtained. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.28% (20th percentile).
Denial of service in Tomofun Furbo 360 and Furbo Mini pet cameras occurs through the Registration Handler when a physically present attacker with low-privilege authenticated access manipulates an unspecified function, causing availability loss (CWE-404). Exploitation requires direct physical access and is described as high-complexity/difficult, so remote or at-scale attacks are not feasible; EPSS is low (0.15%) and no public exploit has been identified at time of analysis. Affected firmware is Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074, and the vendor did not respond to disclosure.
Physical manipulation of the Trial Restriction Handler on Tomofun Furbo 360 (through firmware FB0035_FW_036) and Furbo Mini (through MC0020_FW_074) can improperly bypass access controls, with low confidentiality, integrity, and availability impact. The attack requires hands-on device access and is rated high complexity and difficult to exploit; no public exploit identified at time of analysis, and EPSS is 0.18% (8th percentile). This is a confirmed access-control weakness but a low-priority risk because it cannot be triggered remotely.
Cleartext transmission of sensitive information over Bluetooth Low Energy in Tomofun Furbo 360 and Furbo Mini firmware (Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074) gives an attacker within BLE radio range access to limited confidential data. The issue is rated CVSS 2.3 because exploitation requires adjacent proximity and is highly complex, and only confidentiality is affected. No public exploit identified at time of analysis, EPSS is 0.22% (11th percentile), and the vendor did not respond to the disclosure.
Insecure local storage in Tomofun Furbo 360 and Furbo Mini firmware lets authenticated local users with low privileges access sensitive information written by collect_logs.sh in the Debug Log S3 Bucket Handler before upload. The flaw affects Furbo 360 through FB0035_FW_036 and Furbo Mini through MC0020_FW_074; publicly available exploit code exists, but EPSS is low at 0.24% (13th percentile) and there is no CISA KEV confirmation of active exploitation. Impact is limited to low confidentiality disclosure, with no integrity or availability effect and no remote attack path.
Denial of service in Tomofun Furbo 360 and Furbo Mini cameras allows unauthenticated attackers on the adjacent network (Bluetooth range) to disrupt device availability via the Bluetooth Handler. The flaw stems from improper resource shutdown or release (CWE-404) and affects firmware versions up to FB0035_FW_036 (Furbo 360) and MC0020_FW_074 (Furbo Mini). No public exploit code has been identified at time of analysis, and EPSS is low at 0.34% (26th percentile); real-world risk is bounded to local proximity and limited availability impact.
Physical access to the UART debug interface on Tomofun Furbo 360 (firmware up to FB0035_FW_036) and Furbo Mini (up to MC0020_FW_074) allows an attacker with hands-on possession of the device to disclose sensitive information from the camera. The flaw is a CWE-200 information exposure issue rated CVSS 2.4 (CVSS 4.0 AV:P), and publicly available exploit code exists; EPSS is 0.19% (8th percentile), consistent with a low-risk, physical-only attack. No authentication is required once UART access is obtained, but the attack cannot be performed remotely.
Tomofun Furbo 360 and Furbo Mini dog cameras running firmware up to FB0035_FW_036 and MC0020_FW_074 do not properly validate TLS certificates when collect_logs.sh invokes upload_file_to_s3 for Amazon S3 log uploads, letting an attacker who already holds a man-in-the-middle position intercept or tamper with log data. Exploitation is remote but high-complexity and described as difficult, with no public exploit identified at time of analysis and a low EPSS score of 0.26% (17th percentile). The vendor was contacted but did not respond, so no official patch is available.
Weak cryptographic hash implementation in Tomofun Furbo 360 and Furbo Mini firmware allows local attackers with low privileges to compromise password security through use of insecure encryption algorithms in the password handler. The vulnerability affects Furbo 360 up to firmware version FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though real-world exploitation requires physical device access and high technical complexity.
A hard-coded root password in the Tomofun Furbo 360 and Furbo Mini pet cameras allows local attackers with low privileges to achieve full device compromise (confidentiality, integrity, and availability impact). Exploitation requires local access and high attack complexity, and a public proof-of-concept exists on GitHub. At the time of analysis, EPSS estimates a 0.02% probability of exploitation, and no active exploitation has been reported.
Server-side request forgery in Tomofun Furbo 360 and Furbo Mini dog cameras allows remote attackers to manipulate the TF_FQDN.json configuration file via the GATT Interface URL Handler, enabling arbitrary internal network requests with low confidentiality and integrity impact. Affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though the attack requires high complexity and is not actively exploited at scale per EPSS data (0.06%, percentile 18%).
Information disclosure vulnerability in Tomofun Furbo 360 and Furbo Mini dog cameras allows local network attackers to extract sensitive DeviceToken data via manipulation of GATT Service arguments. The attack requires high technical complexity and adjacency to the target network. Publicly available exploit code exists; however, the extremely low EPSS score (0.03%) and requirement for local network access and high attack complexity suggest limited real-world exploitation likelihood despite POC availability.
Improper access controls in the GATT Service of Tomofun Furbo 360 and Furbo Mini dog cameras allow local network attackers to disclose sensitive information without authentication. Affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though the low CVSS score of 2.1 and minimal EPSS (0.03%) reflect the local network-only attack vector and information disclosure impact.
Insecure storage of sensitive information in Tomofun Furbo 360 and Furbo Mini dog cameras via UART interface allows physical attackers to extract unencrypted credentials and private data from firmware versions Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vulnerability requires physical device access and high technical complexity but publicly available exploit code exists. Vendor did not respond to early disclosure notification.
Hard-coded MQTT client certificate credentials in Furbo 360 (up to FB0035_FW_036) and Furbo Mini (up to MC0020_FW_074) firmware allow an attacker who extracts the static secret from the /squashfs-root/furbo_img image to authenticate to the device MQTT service and tamper with communications, with only low integrity impact assessed. Attack complexity is high because the credential must first be recovered offline from firmware, and no authentication or user interaction is needed once it is obtained. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.28% (20th percentile).
Denial of service in Tomofun Furbo 360 and Furbo Mini pet cameras occurs through the Registration Handler when a physically present attacker with low-privilege authenticated access manipulates an unspecified function, causing availability loss (CWE-404). Exploitation requires direct physical access and is described as high-complexity/difficult, so remote or at-scale attacks are not feasible; EPSS is low (0.15%) and no public exploit has been identified at time of analysis. Affected firmware is Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074, and the vendor did not respond to disclosure.
Physical manipulation of the Trial Restriction Handler on Tomofun Furbo 360 (through firmware FB0035_FW_036) and Furbo Mini (through MC0020_FW_074) can improperly bypass access controls, with low confidentiality, integrity, and availability impact. The attack requires hands-on device access and is rated high complexity and difficult to exploit; no public exploit identified at time of analysis, and EPSS is 0.18% (8th percentile). This is a confirmed access-control weakness but a low-priority risk because it cannot be triggered remotely.
Cleartext transmission of sensitive information over Bluetooth Low Energy in Tomofun Furbo 360 and Furbo Mini firmware (Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074) gives an attacker within BLE radio range access to limited confidential data. The issue is rated CVSS 2.3 because exploitation requires adjacent proximity and is highly complex, and only confidentiality is affected. No public exploit identified at time of analysis, EPSS is 0.22% (11th percentile), and the vendor did not respond to the disclosure.
Insecure local storage in Tomofun Furbo 360 and Furbo Mini firmware lets authenticated local users with low privileges access sensitive information written by collect_logs.sh in the Debug Log S3 Bucket Handler before upload. The flaw affects Furbo 360 through FB0035_FW_036 and Furbo Mini through MC0020_FW_074; publicly available exploit code exists, but EPSS is low at 0.24% (13th percentile) and there is no CISA KEV confirmation of active exploitation. Impact is limited to low confidentiality disclosure, with no integrity or availability effect and no remote attack path.
Denial of service in Tomofun Furbo 360 and Furbo Mini cameras allows unauthenticated attackers on the adjacent network (Bluetooth range) to disrupt device availability via the Bluetooth Handler. The flaw stems from improper resource shutdown or release (CWE-404) and affects firmware versions up to FB0035_FW_036 (Furbo 360) and MC0020_FW_074 (Furbo Mini). No public exploit code has been identified at time of analysis, and EPSS is low at 0.34% (26th percentile); real-world risk is bounded to local proximity and limited availability impact.
Physical access to the UART debug interface on Tomofun Furbo 360 (firmware up to FB0035_FW_036) and Furbo Mini (up to MC0020_FW_074) allows an attacker with hands-on possession of the device to disclose sensitive information from the camera. The flaw is a CWE-200 information exposure issue rated CVSS 2.4 (CVSS 4.0 AV:P), and publicly available exploit code exists; EPSS is 0.19% (8th percentile), consistent with a low-risk, physical-only attack. No authentication is required once UART access is obtained, but the attack cannot be performed remotely.
Tomofun Furbo 360 and Furbo Mini dog cameras running firmware up to FB0035_FW_036 and MC0020_FW_074 do not properly validate TLS certificates when collect_logs.sh invokes upload_file_to_s3 for Amazon S3 log uploads, letting an attacker who already holds a man-in-the-middle position intercept or tamper with log data. Exploitation is remote but high-complexity and described as difficult, with no public exploit identified at time of analysis and a low EPSS score of 0.26% (17th percentile). The vendor was contacted but did not respond, so no official patch is available.