CVE-2025-11646: falha de média gravidade em Tomofun Furbo 360
Tomofun Furbo 360/Furbo Mini GATT Service access control
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.6%
A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation results in improper access controls. The attack can only be performed from the local network. The exploit is now public and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVEs relacionadas — Tomofun Furbo 360
No mesmo produto, das mais perigosas para as menos.
CVE-2025-11647LOWTomofun Furbo 360/Furbo Mini GATT Service information disclosureEPSS 0.6%CVE-2025-11635MEDIUMTomofun Furbo 360 File Upload resource consumptionEPSS 0.5%CVE-2025-11648MEDIUMTomofun Furbo 360/Furbo Mini GATT Interface URL TF_FQDN.json server-side request forgeryEPSS 0.5%CVE-2025-11636MEDIUMTomofun Furbo 360 Account server-side request forgeryEPSS 0.4%CVE-2025-11638MEDIUMTomofun Furbo 360/Furbo Mini Bluetooth denial of serviceEPSS 0.3%CVE-2025-11637MEDIUMTomofun Furbo 360 Audio race conditionEPSS 0.3%