VDB-328059 · CVE-2025-11648 · EUVD-2025-33913

Tomofun Furbo 360/Furbo Mini GATT Interface URL TF_FQDN.json ବିସ୍ତାରିତ ଅଧିକାର

Rakkoon nageenyaa kan ଜଟିଳ jedhamuun beekamu Tomofun Furbo 360 and Furbo Mini keessatti argameera. Kan miidhamte is hojii hin beekamne faayilii TF_FQDN.json keessa kutaa GATT Interface URL Handler keessa. Hojii jijjiirraa gara ବିସ୍ତାରିତ ଅଧିକାର geessa. CWE fayyadamuun rakkoo ibsuun gara CWE-918 geessa. Dogoggorri 05/15/2025 keessatti argame. Dadhabbii kana yeroo 10/11/2025 maxxanfameera kan maxxansiise Calvin Star, Julian B (skelet4r and dead1nfluence) waliin Software Secured. Odeeffannoon kun buufachuuf github.com irratti qoodameera. Dogoggorri kun akka CVE-2025-11648tti beekama. Yaaliin weeraraa fageenya irraa jalqabamuu ni danda'a. Faayidaaleen teeknikaa ni jiru. Waliigalatti, meeshaa balaa kana fayyadamuuf jiru. Amma, gatii ammee exploit might be approx. USD $0-$5k ta'uu danda'a. Akka ପ୍ରୁଫ୍-ଅଫ୍-କନ୍ସେପ୍ଟ jedhamee ibsameera. Carraa exploit kana github.com irraa buufachuun ni danda'ama. Hanqinni kun guyyoota 148 caalaa akka zero-day kan ummataaf hin ifneetti fayyadamee ture. Akka 0-daytti, gatii daldalaa dhoksaa tilmaamame $0-$5k ta'ee ture. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

6 ଆଡାପ୍ଟେସନ୍ · 117 ପଏଣ୍ଟ

ଫିଲ୍ଡ	ଅଦ୍ୟତନ 1/5 10/13/2025 01:02 AM	ଅଦ୍ୟତନ 2/5 10/13/2025 02:20 AM	ଅଦ୍ୟତନ 3/5 10/20/2025 06:37 AM	ଅଦ୍ୟତନ 4/5 10/20/2025 06:38 AM	ଅଦ୍ୟତନ 5/5 10/28/2025 05:55 AM
software_vendor	Tomofun	Tomofun	Tomofun	Tomofun	Tomofun
software_name	Furbo 360/Furbo Mini	Furbo 360/Furbo Mini	Furbo 360/Furbo Mini	Furbo 360/Furbo Mini	Furbo 360/Furbo Mini
software_component	GATT Interface URL Handler	GATT Interface URL Handler	GATT Interface URL Handler	GATT Interface URL Handler	GATT Interface URL Handler
software_file	TF_FQDN.json	TF_FQDN.json	TF_FQDN.json	TF_FQDN.json	TF_FQDN.json
vulnerability_cwe	CWE-918 (ବିସ୍ତାରିତ ଅଧିକାର)	CWE-918 (ବିସ୍ତାରିତ ଅଧିକାର)	CWE-918 (ବିସ୍ତାରିତ ଅଧିକାର)	CWE-918 (ବିସ୍ତାରିତ ଅଧିକାର)	CWE-918 (ବିସ୍ତାରିତ ଅଧିକାର)
vulnerability_risk	2	2	2	2	2
cvss3_vuldb_av	N	N	N	N	N
cvss3_vuldb_ac	H	H	H	H	H
cvss3_vuldb_pr	N	N	N	N	N
cvss3_vuldb_ui	N	N	N	N	N
cvss3_vuldb_s	U	U	U	U	U
cvss3_vuldb_c	L	L	L	L	L
cvss3_vuldb_i	L	L	L	L	L
cvss3_vuldb_a	L	L	L	L	L
cvss3_vuldb_e	P	P	P	P	P
cvss3_vuldb_rc	R	R	R	R	R
advisory_url	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md
exploit_availability	1	1	1	1	1
exploit_publicity	1	1	1	0	0
exploit_url	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md	https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md
source_cve	CVE-2025-11648	CVE-2025-11648	CVE-2025-11648	CVE-2025-11648	CVE-2025-11648
cna_responsible	VulDB	VulDB	VulDB	VulDB	VulDB
response_summary	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.
decision_summary	The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.	The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.	The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.	The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.	The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.
cvss2_vuldb_av	N	N	N	N	N
cvss2_vuldb_ac	H	H	H	H	H
cvss2_vuldb_au	N	N	N	N	N
cvss2_vuldb_ci	P	P	P	P	P
cvss2_vuldb_ii	P	P	P	P	P
cvss2_vuldb_ai	P	P	P	P	P
cvss2_vuldb_e	POC	POC	POC	POC	POC
cvss2_vuldb_rc	UR	UR	UR	UR	UR
cvss4_vuldb_av	N	N	N	N	N
cvss4_vuldb_ac	H	H	H	H	H
cvss4_vuldb_pr	N	N	N	N	N
cvss4_vuldb_ui	N	N	N	N	N
cvss4_vuldb_vc	L	L	L	L	L
cvss4_vuldb_vi	L	L	L	L	L
cvss4_vuldb_va	L	L	L	L	L
cvss4_vuldb_e	P	P	P	P	P
cvss2_vuldb_rl	ND	ND	ND	ND	ND
cvss3_vuldb_rl	X	X	X	X	X
cvss4_vuldb_at	N	N	N	N	N
cvss4_vuldb_sc	N	N	N	N	N
cvss4_vuldb_si	N	N	N	N	N
cvss4_vuldb_sa	N	N	N	N	N
cvss2_vuldb_basescore	5.1	5.1	5.1	5.1	5.1
cvss2_vuldb_tempscore	4.4	4.4	4.4	4.4	4.4
cvss3_vuldb_basescore	5.6	5.6	5.6	5.6	5.6
cvss3_vuldb_tempscore	5.1	5.1	5.1	5.1	5.1
cvss3_meta_basescore	5.6	5.6	5.6	5.6	6.2
cvss3_meta_tempscore	5.3	5.3	5.3	5.3	6.0
cvss4_vuldb_bscore	6.3	6.3	6.3	6.3	6.3
cvss4_vuldb_btscore	2.9	2.9	2.9	2.9	2.9
advisory_date	1760133600 (10/11/2025)	1760133600 (10/11/2025)	1760133600 (10/11/2025)	1760133600 (10/11/2025)	1760133600 (10/11/2025)
price_0day	$0-$5k	$0-$5k	$0-$5k	$0-$5k	$0-$5k
cve_nvd_summary	A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.	A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.	A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.	A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.	A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
cvss4_cna_av	N	N	N	N	N
cvss4_cna_ac	H	H	H	H	H
cvss4_cna_at	N	N	N	N	N
cvss4_cna_pr	N	N	N	N	N
cvss4_cna_ui	N	N	N	N	N
cvss4_cna_vc	L	L	L	L	L
cvss4_cna_vi	L	L	L	L	L
cvss4_cna_va	L	L	L	L	L
cvss4_cna_sc	N	N	N	N	N
cvss4_cna_si	N	N	N	N	N
cvss4_cna_sa	N	N	N	N	N
cvss4_cna_bscore	6.3	6.3	6.3	6.3	6.3
cvss3_cna_av	N	N	N	N	N
cvss3_cna_ac	H	H	H	H	H
cvss3_cna_pr	N	N	N	N	N
cvss3_cna_ui	N	N	N	N	N
cvss3_cna_s	U	U	U	U	U
cvss3_cna_c	L	L	L	L	L
cvss3_cna_i	L	L	L	L	L
cvss3_cna_a	L	L	L	L	L
cvss3_cna_basescore	5.6	5.6	5.6	5.6	5.6
cvss2_cna_av	N	N	N	N	N
cvss2_cna_ac	H	H	H	H	H
cvss2_cna_au	N	N	N	N	N
cvss2_cna_ci	P	P	P	P	P
cvss2_cna_ii	P	P	P	P	P
cvss2_cna_ai	P	P	P	P	P
cvss2_cna_basescore	5.1	5.1	5.1	5.1	5.1
euvd_id		EUVD-2025-33913	EUVD-2025-33913	EUVD-2025-33913	EUVD-2025-33913
advisory_falsepositive			0	0	0
person_nickname			skelet4r/dead1nfluence	skelet4r/dead1nfluence	skelet4r/dead1nfluence
advisory_freeformen			An attacker within Bluetooth Low Energy (BLE) range of a Furbo Mini device can overwrite the configuration endpoint used by the device to fetch critical files such as TF_FQDN.json. By providing a custom URL via the GATT interface, the attacker can cause the Furbo to reach out to a remote attacker-controlled server during setup.	An attacker within Bluetooth Low Energy (BLE) range of a Furbo Mini device can overwrite the configuration endpoint used by the device to fetch critical files such as TF_FQDN.json. By providing a custom URL via the GATT interface, the attacker can cause the Furbo to reach out to a remote attacker-controlled server during setup.	An attacker within Bluetooth Low Energy (BLE) range of a Furbo Mini device can overwrite the configuration endpoint used by the device to fetch critical files such as TF_FQDN.json. By providing a custom URL via the GATT interface, the attacker can cause the Furbo to reach out to a remote attacker-controlled server during setup.
company_website			https://www.softwaresecured.com/blog	https://www.softwaresecured.com/blog	https://www.softwaresecured.com/blog
exploit_language			Python	Python	Python
exploit_freeformen				Preparation: 1. Acquire a BLE-capable adapter (e.g., Nordic nRF52840). 2. Obtain or build a script (Furbo_Master.py) that allows interaction with Furbo's GATT characteristics. 3. Set up an HTTP server to host a crafted TF_FQDN.json file (e.g., using Python’s http.server). Replication: 1. Start the Furbo_Master.py script. 2. Scan and connect to the Furbo Mini device. 3. Execute the send_endpoint command and specify a URL pointing to your HTTP server. 4. Run the register_info_ready command to commit the configuration change. 5. Exit the Python script with the exit command. 6. Resume setup of the camera using the official Furbo mobile app. 7. Observe the Furbo device making an HTTP request to your specified endpoint, retrieving and saving the malicious configuration file.	Preparation: 1. Acquire a BLE-capable adapter (e.g., Nordic nRF52840). 2. Obtain or build a script (Furbo_Master.py) that allows interaction with Furbo's GATT characteristics. 3. Set up an HTTP server to host a crafted TF_FQDN.json file (e.g., using Python’s http.server). Replication: 1. Start the Furbo_Master.py script. 2. Scan and connect to the Furbo Mini device. 3. Execute the send_endpoint command and specify a URL pointing to your HTTP server. 4. Run the register_info_ready command to commit the configuration change. 5. Exit the Python script with the exit command. 6. Resume setup of the camera using the official Furbo mobile app. 7. Observe the Furbo device making an HTTP request to your specified endpoint, retrieving and saving the malicious configuration file.
advisory_disputed				0	0
company_name				Software Secured	Software Secured
exploit_wormified				0	0
person_name				Calvin Star/Julian B	Calvin Star/Julian B
vulnerability_discoverydate				1747332000 (05/15/2025)	1747332000 (05/15/2025)
developer_nickname				Skelet4r	Skelet4r
developer_name				Calvin Star	Calvin Star
vulnerability_historic				0	0
software_type				Firmware Software	Firmware Software
vulnerability_vendorinformdate				1750539600 (06/21/2025)	1750539600 (06/21/2025)
advisory_confirm_date				1751509800 (07/03/2025)	1751509800 (07/03/2025)
cvss3_nvd_av					N
cvss3_nvd_ac					H
cvss3_nvd_pr					N
cvss3_nvd_ui					N
cvss3_nvd_s					U
cvss3_nvd_c					N
cvss3_nvd_i					H
cvss3_nvd_a					H
cvss3_nvd_basescore					7.4

◂ ପଛକୁ ସମୀକ୍ଷା ଆହୁରି ଦୂରରେ ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!