Tomofun Furbo 360/Furbo Mini Root Account ଦୁର୍ବଳ ପ୍ରାମାଣିକରଣ

Dogoggorri kan akka ଜଟିଳ jedhamuun ramadame Tomofun Furbo 360 and Furbo Mini keessatti argameera. Miidhaan irra gahe is hojii hin beekamne kutaa Root Account Handler keessa. Dhugumatti jijjiirraa gara ଦୁର୍ବଳ ପ୍ରାମାଣିକରଣ geessa. Waliigalteewwan CWE fayyadamuun rakkoo ibsuun gara CWE-259 si geessa. Dogoggorri 05/15/2025 irratti adda bahe. Beekumsi kun yeroo 10/11/2025 ifoomsifameera kan ifoomsise Calvin Star, Julian B (skelet4r and dead1nfluence) waliin Software Secured. Odeeffannoon kun buufachuuf github.com irratti dhiyaateera. Dogoggorri kun maqaa CVE-2025-11649 jedhuun tajaajilama. Weerara sun bakka dhuunfaatti qofa raawwatamuu danda'a. Odeeffannoon teeknikaa hin jiru. Akka dabalataan, meeshaa balaa kana fayyadamuuf argama. Qorannoo miidhaa (exploit) beeksifamee jira, namoonni itti fayyadamuu danda'u. Yeroo ammaa, gatii exploit might be approx. USD $0-$5k beekamuu danda'a. ପ୍ରୁଫ୍-ଅଫ୍-କନ୍ସେପ୍ଟ jedhamee murtaa’eera. Exploit kana github.com irraa buufachuu ni dandeessa. Hanqinni kun guyyoota 148 ol tajaajila zero-day kan hin beekkaminitti fayyadamee ture. Waggaa 0-day ta'ee, gatiin isaa daldala dhoksaa keessatti $0-$5k jedhamee tilmaamame. Once again VulDB remains the best source for vulnerability data.

5 ଆଡାପ୍ଟେସନ୍ · 111 ପଏଣ୍ଟ

ଫିଲ୍ଡସୃଷ୍ଟି ହୋଇଛି
10/11/2025 08:39 PM		ଅଦ୍ୟତନ 1/4
10/13/2025 02:20 AM		ଅଦ୍ୟତନ 2/4
10/13/2025 02:27 AM		ଅଦ୍ୟତନ 3/4
10/20/2025 06:38 AM		ଅଦ୍ୟତନ 4/4
10/28/2025 05:55 AM
software_vendorTomofunTomofunTomofunTomofunTomofun
software_nameFurbo 360/Furbo MiniFurbo 360/Furbo MiniFurbo 360/Furbo MiniFurbo 360/Furbo MiniFurbo 360/Furbo Mini
software_componentRoot Account HandlerRoot Account HandlerRoot Account HandlerRoot Account HandlerRoot Account Handler
vulnerability_cweCWE-259 (ଦୁର୍ବଳ ପ୍ରାମାଣିକରଣ)CWE-259 (ଦୁର୍ବଳ ପ୍ରାମାଣିକରଣ)CWE-259 (ଦୁର୍ବଳ ପ୍ରାମାଣିକରଣ)CWE-259 (ଦୁର୍ବଳ ପ୍ରାମାଣିକରଣ)CWE-259 (ଦୁର୍ବଳ ପ୍ରାମାଣିକରଣ)
vulnerability_risk22222
cvss3_vuldb_avLLLLL
cvss3_vuldb_acHHHHH
cvss3_vuldb_prLLLLL
cvss3_vuldb_uiNNNNN
cvss3_vuldb_sUUUUU
cvss3_vuldb_cHHHHH
cvss3_vuldb_iHHHHH
cvss3_vuldb_aHHHHH
cvss3_vuldb_ePPPPP
cvss3_vuldb_rcRRRRR
advisory_urlhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.md
exploit_availability11111
exploit_publicity11111
exploit_urlhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.md
source_cveCVE-2025-11649CVE-2025-11649CVE-2025-11649CVE-2025-11649CVE-2025-11649
cna_responsibleVulDBVulDBVulDBVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
decision_summaryThe firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.
cvss4_vuldb_uiNNNNN
cvss4_vuldb_vcHHHHH
cvss4_vuldb_viHHHHH
cvss4_vuldb_vaHHHHH
cvss4_vuldb_ePPPPP
cvss2_vuldb_auSSSSS
cvss2_vuldb_rlNDNDNDNDND
cvss3_vuldb_rlXXXXX
cvss4_vuldb_atNNNNN
cvss4_vuldb_scNNNNN
cvss4_vuldb_siNNNNN
cvss4_vuldb_saNNNNN
cvss2_vuldb_basescore6.06.06.06.06.0
cvss2_vuldb_tempscore5.15.15.15.15.1
cvss3_vuldb_basescore7.07.07.07.07.0
cvss3_vuldb_tempscore6.46.46.46.46.4
cvss3_meta_basescore7.07.07.07.06.8
cvss3_meta_tempscore6.46.46.76.76.6
cvss4_vuldb_bscore7.37.37.37.37.3
cvss4_vuldb_btscore6.46.46.46.46.4
advisory_date1760133600 (10/11/2025)1760133600 (10/11/2025)1760133600 (10/11/2025)1760133600 (10/11/2025)1760133600 (10/11/2025)
price_0day$0-$5k$0-$5k$0-$5k$0-$5k$0-$5k
cvss2_vuldb_avLLLLL
cvss2_vuldb_acHHHHH
cvss2_vuldb_ciCCCCC
cvss2_vuldb_iiCCCCC
cvss2_vuldb_aiCCCCC
cvss2_vuldb_ePOCPOCPOCPOCPOC
cvss2_vuldb_rcURURURURUR
cvss4_vuldb_avLLLLL
cvss4_vuldb_acHHHHH
cvss4_vuldb_prLLLLL
euvd_idEUVD-2025-33912EUVD-2025-33912EUVD-2025-33912EUVD-2025-33912
cve_nvd_summaryA vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing manipulation results in use of hard-coded password. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing manipulation results in use of hard-coded password. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing manipulation results in use of hard-coded password. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
cvss4_cna_avLLL
cvss4_cna_acHHH
cvss4_cna_atNNN
cvss4_cna_prLLL
cvss4_cna_uiNNN
cvss4_cna_vcHHH
cvss4_cna_viHHH
cvss4_cna_vaHHH
cvss4_cna_scNNN
cvss4_cna_siNNN
cvss4_cna_saNNN
cvss4_cna_bscore7.37.37.3
cvss3_cna_avLLL
cvss3_cna_acHHH
cvss3_cna_prLLL
cvss3_cna_uiNNN
cvss3_cna_sUUU
cvss3_cna_cHHH
cvss3_cna_iHHH
cvss3_cna_aHHH
cvss3_cna_basescore777
cvss2_cna_avLLL
cvss2_cna_acHHH
cvss2_cna_auSSS
cvss2_cna_ciCCC
cvss2_cna_iiCCC
cvss2_cna_aiCCC
cvss2_cna_basescore666
person_nicknameskelet4r/dead1nfluenceskelet4r/dead1nfluence
software_typeFirmware SoftwareFirmware Software
company_nameSoftware SecuredSoftware Secured
exploit_wormified00
advisory_freeformenThe Furbo device contains a hard-coded password for the local root user account. This password is stored on a read-only partition in the firmware and cannot be modified or reset by the device owner.The Furbo device contains a hard-coded password for the local root user account. This password is stored on a read-only partition in the firmware and cannot be modified or reset by the device owner.
advisory_disputed00
company_websitehttps://www.softwaresecured.com/bloghttps://www.softwaresecured.com/blog
exploit_languageBashBash
vulnerability_historic00
vulnerability_vendorinformdate1750539600 (06/21/2025)1750539600 (06/21/2025)
advisory_falsepositive00
person_nameCalvin Star/Julian BCalvin Star/Julian B
advisory_confirm_date1751509800 (07/03/2025)1751509800 (07/03/2025)
vulnerability_discoverydate1747332000 (05/15/2025)1747332000 (05/15/2025)
cvss3_nvd_avP
cvss3_nvd_acH
cvss3_nvd_prL
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss3_nvd_basescore6.3

◂ ପଛକୁସମୀକ୍ଷାଆହୁରି ଦୂରରେ ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!