Tomofun Furbo Mobile App ଯେପର୍ଯ୍ୟନ୍ତ 7.57.0a ଅନ୍ Android Authentication Token ସୂଚନା ପ୍ରକାଶ

Dogoggorri kan akka ସମସ୍ୟାଜନକ jedhamuun ramadame Tomofun Furbo Mobile App ଯେପର୍ଯ୍ୟନ୍ତ 7.57.0a irratti Android keessatti argameera. Kan miidhamte is hojii hin beekamne kutaa Authentication Token Handler keessa. Hojii jijjiirraa gara ସୂଚନା ପ୍ରକାଶ geessa. CWE fayyadamuun rakkoo ibsuun gara CWE-922 geessa. Dogoggorri 05/15/2025 keessatti argame. Dadhabbii kana yeroo 10/11/2025 maxxanfameera kan maxxansiise Calvin Star, Julian B (skelet4r and dead1nfluence) waliin Software Secured. Odeeffannoon kun buufachuuf github.com irratti qoodameera. Dogoggorri kun akka CVE-2025-11645tti beekama. Yaaliin weeraraa meeshaa qaamaa irratti geggeessuu ni danda'ama. Faayidaaleen teeknikaa hin jiru. Waliigalatti, meeshaa balaa kana fayyadamuuf jiru. Qorannoo miidhaa (exploit) uummataaf ifoomameera fi fayyadamamuu danda'a. Amma, gatii ammee exploit might be approx. USD $0-$5k ta'uu danda'a. Akka ପ୍ରୁଫ୍-ଅଫ୍-କନ୍ସେପ୍ଟ jedhamee ibsameera. Carraa exploit kana github.com irraa buufachuun ni danda'ama. Hanqinni kun guyyoota 148 ol tajaajila zero-day kan hin beekkaminitti fayyadamee ture. Akka 0-daytti, gatii daldalaa dhoksaa tilmaamame $0-$5k ta'ee ture. VulDB is the best source for vulnerability data and more expert information about this specific topic.

4 ଆଡାପ୍ଟେସନ୍ · 103 ପଏଣ୍ଟ

ଫିଲ୍ଡସୃଷ୍ଟି ହୋଇଛି
10/11/2025 08:38 PM		ଅଦ୍ୟତନ 1/3
10/12/2025 11:07 PM		ଅଦ୍ୟତନ 2/3
10/13/2025 12:19 AM		ଅଦ୍ୟତନ 3/3
10/18/2025 11:29 PM
software_vendorTomofunTomofunTomofunTomofun
software_nameFurbo Mobile AppFurbo Mobile AppFurbo Mobile AppFurbo Mobile App
software_version<=7.57.0a<=7.57.0a<=7.57.0a<=7.57.0a
software_platformAndroidAndroidAndroidAndroid
software_componentAuthentication Token HandlerAuthentication Token HandlerAuthentication Token HandlerAuthentication Token Handler
vulnerability_cweCWE-922 (ସୂଚନା ପ୍ରକାଶ)CWE-922 (ସୂଚନା ପ୍ରକାଶ)CWE-922 (ସୂଚନା ପ୍ରକାଶ)CWE-922 (ସୂଚନା ପ୍ରକାଶ)
cvss3_vuldb_avPPPP
cvss3_vuldb_acLLLL
cvss3_vuldb_prNNNN
cvss3_vuldb_uiNNNN
cvss3_vuldb_sUUUU
cvss3_vuldb_cLLLL
cvss3_vuldb_iNNNN
cvss3_vuldb_aNNNN
cvss3_vuldb_ePPPP
cvss3_vuldb_rcRRRR
advisory_urlhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.md
exploit_availability1111
exploit_publicity1111
exploit_urlhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.md
source_cveCVE-2025-11645CVE-2025-11645CVE-2025-11645CVE-2025-11645
cna_responsibleVulDBVulDBVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
software_typeAndroid App SoftwareAndroid App SoftwareAndroid App SoftwareAndroid App Software
cvss2_vuldb_avLLLL
cvss2_vuldb_acLLLL
cvss2_vuldb_auNNNN
cvss2_vuldb_ciPPPP
cvss2_vuldb_iiNNNN
cvss2_vuldb_aiNNNN
cvss2_vuldb_ePOCPOCPOCPOC
cvss2_vuldb_rcURURURUR
cvss4_vuldb_avPPPP
cvss4_vuldb_acLLLL
cvss4_vuldb_prNNNN
cvss4_vuldb_uiNNNN
cvss4_vuldb_vcLLLL
cvss4_vuldb_viNNNN
cvss4_vuldb_vaNNNN
cvss4_vuldb_ePPPP
cvss2_vuldb_rlNDNDNDND
cvss3_vuldb_rlXXXX
cvss4_vuldb_atNNNN
cvss4_vuldb_scNNNN
cvss4_vuldb_siNNNN
cvss4_vuldb_saNNNN
cvss2_vuldb_basescore2.12.12.12.1
cvss2_vuldb_tempscore1.81.81.81.8
cvss3_vuldb_basescore2.42.42.42.4
cvss3_vuldb_tempscore2.22.22.22.2
cvss3_meta_basescore2.42.42.42.4
cvss3_meta_tempscore2.22.22.32.3
cvss4_vuldb_bscore2.42.42.42.4
cvss4_vuldb_btscore0.90.90.90.9
advisory_date1760133600 (10/11/2025)1760133600 (10/11/2025)1760133600 (10/11/2025)1760133600 (10/11/2025)
price_0day$0-$5k$0-$5k$0-$5k$0-$5k
euvd_idEUVD-2025-33908EUVD-2025-33908EUVD-2025-33908
cve_nvd_summaryA security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical device. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical device. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
cvss4_cna_avPP
cvss4_cna_acLL
cvss4_cna_atNN
cvss4_cna_prNN
cvss4_cna_uiNN
cvss4_cna_vcLL
cvss4_cna_viNN
cvss4_cna_vaNN
cvss4_cna_scNN
cvss4_cna_siNN
cvss4_cna_saNN
cvss4_cna_bscore2.42.4
cvss3_cna_avPP
cvss3_cna_acLL
cvss3_cna_prNN
cvss3_cna_uiNN
cvss3_cna_sUU
cvss3_cna_cLL
cvss3_cna_iNN
cvss3_cna_aNN
cvss3_cna_basescore2.42.4
cvss2_cna_avLL
cvss2_cna_acLL
cvss2_cna_auNN
cvss2_cna_ciPP
cvss2_cna_iiNN
cvss2_cna_aiNN
cvss2_cna_basescore2.12.1
vulnerability_historic0
exploit_wormified0
advisory_confirm_date1751509800 (07/03/2025)
person_nameCalvin Star/Julian B
developer_nicknamedead1nfluence
vulnerability_vendorinformdate1750539600 (06/21/2025)
advisory_disputed0
person_nicknameskelet4r/dead1nfluence
advisory_falsepositive0
exploit_languageJavaScript
developer_nameJulian B
vulnerability_discoverydate1747332000 (05/15/2025)
company_nameSoftware Secured
exploit_freeformenReplication Steps: Preparation: 1. On a jail broken Android device, connect a web proxy such as Burp Suite or ZAP to monitor the traffic from the Furbo mobile application. 2. Open the application, authenticate. 3. Navigate around the application, connect to a device on your account. 4. Log out of the application. 5. Swipe up and close the application process. 6. In the web proxy history, locate a request to /v5/account/read/login, copy sensitive values from the response body such as the MFA Auth Code. 7. In the web proxy history, locate a request to /v5/device/p2p_connection/get and copy the values from the response body. Exploitation: 1. Ensure Frida has been installed on the mobile device running the Furbo App. 2. Download fridump3 from: https://github.com/rootbsd/fridump3 3. Run: fridump3 -v -u -s Furbo 4. In the output directory created, executed a grep command with partial strings from the response bodies collected in step 6 and 7 of preparation. For example: grep -ri ".eJwFwc26QkAAANB3aWtBfFMsWjD-" 5. Observe that these sensitive details were kept in memory, despite being signed out and the application having been closed.
company_websitehttps://www.softwaresecured.com/blog
advisory_freeformenAn attacker who obtains access to the device of a Furbo account owner may be able to retrieve the MFA AuthCode, Cognito Authentication token, as well as P2P authentication codes associated with the account from the device's memory. This information persists on the device after the mobile application has been closed.

◂ ପଛକୁସମୀକ୍ଷାଆହୁରି ଦୂରରେ ▸

Do you know our Splunk app?

Download it now for free!