Tomofun Furbo 360/Furbo Mini Password /etc/shadow ଦୁର୍ବଳ ଏନକ୍ରିପସନ୍

Rakkoon nageenyaa kan ସମସ୍ୟାଜନକ jedhamuun beekamu Tomofun Furbo 360 and Furbo Mini keessatti argameera. Miidhamni argame is hojii hin beekamne faayilii /etc/shadow keessa kutaa Password Handler keessa. Wanti jijjiirame gara ଦୁର୍ବଳ ଏନକ୍ରିପସନ୍ geessa. Rakkoo ibsuuf CWE yoo fayyadamte gara CWE-328 si geessa. Dogoggorri 05/15/2025 irratti mul’ate. Odeeffannoon kun yeroo 10/11/2025 maxxanfameera kan maxxansiise Calvin Star, Julian B (skelet4r and dead1nfluence) waliin Software Secured. Odeeffannoon kun buufachuuf github.com irratti argama. Dogoggorri kun CVE-2025-11650 jedhamee waamama. Weerara meeshaa qaamaa irratti gaggeessuun ni danda'ama. Ibsa teeknikaa ni jira. Waan dabalataa ta’een, meeshaa balaa kana fayyadamuuf ni jira. Qorannoo miidhaa (exploit) uummataaf ifa taasifameera, kanaafis fayyadamuu ni danda'ama. Ammas, gatii exploit might be approx. USD $0-$5k yeroo ammaa irratti argamuu danda'a. ପ୍ରୁଫ୍-ଅଫ୍-କନ୍ସେପ୍ଟ ta’uu isaa ibsameera. Exploit github.com irraa buufachuun ni danda'ama. Hanqinni kun guyyoota 148 caalaa akka zero-day kan ummataaf hin ifneetti fayyadamee ture. Akka 0-daytti, gatiin isaa daldala dhoksaa keessatti $0-$5k akka ta'e tilmaamameera. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

5 ଆଡାପ୍ଟେସନ୍ · 112 ପଏଣ୍ଟ

ଫିଲ୍ଡସୃଷ୍ଟି ହୋଇଛି
10/11/2025 08:39 PM		ଅଦ୍ୟତନ 1/4
10/13/2025 02:20 AM		ଅଦ୍ୟତନ 2/4
10/13/2025 02:27 AM		ଅଦ୍ୟତନ 3/4
10/20/2025 06:38 AM		ଅଦ୍ୟତନ 4/4
10/28/2025 05:55 AM
software_vendorTomofunTomofunTomofunTomofunTomofun
software_nameFurbo 360/Furbo MiniFurbo 360/Furbo MiniFurbo 360/Furbo MiniFurbo 360/Furbo MiniFurbo 360/Furbo Mini
software_componentPassword HandlerPassword HandlerPassword HandlerPassword HandlerPassword Handler
software_file/etc/shadow/etc/shadow/etc/shadow/etc/shadow/etc/shadow
vulnerability_cweCWE-328 (ଦୁର୍ବଳ ଏନକ୍ରିପସନ୍)CWE-328 (ଦୁର୍ବଳ ଏନକ୍ରିପସନ୍)CWE-328 (ଦୁର୍ବଳ ଏନକ୍ରିପସନ୍)CWE-328 (ଦୁର୍ବଳ ଏନକ୍ରିପସନ୍)CWE-328 (ଦୁର୍ବଳ ଏନକ୍ରିପସନ୍)
vulnerability_risk11111
cvss3_vuldb_avPPPPP
cvss3_vuldb_acHHHHH
cvss3_vuldb_prLLLLL
cvss3_vuldb_uiNNNNN
cvss3_vuldb_sUUUUU
cvss3_vuldb_cLLLLL
cvss3_vuldb_iNNNNN
cvss3_vuldb_aNNNNN
cvss3_vuldb_ePPPPP
cvss3_vuldb_rcRRRRR
advisory_urlhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.md
exploit_availability11111
exploit_publicity11111
exploit_urlhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.mdhttps://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.md
source_cveCVE-2025-11650CVE-2025-11650CVE-2025-11650CVE-2025-11650CVE-2025-11650
cna_responsibleVulDBVulDBVulDBVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
decision_summaryThe firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.
cvss2_vuldb_avLLLLL
cvss2_vuldb_acHHHHH
cvss2_vuldb_ciPPPPP
cvss2_vuldb_iiNNNNN
cvss2_vuldb_aiNNNNN
cvss2_vuldb_ePOCPOCPOCPOCPOC
cvss2_vuldb_rcURURURURUR
cvss4_vuldb_avPPPPP
cvss4_vuldb_acHHHHH
cvss4_vuldb_prLLLLL
cvss4_vuldb_uiNNNNN
cvss4_vuldb_vcLLLLL
cvss4_vuldb_viNNNNN
cvss4_vuldb_vaNNNNN
cvss4_vuldb_ePPPPP
cvss2_vuldb_auSSSSS
cvss2_vuldb_rlNDNDNDNDND
cvss3_vuldb_rlXXXXX
cvss4_vuldb_atNNNNN
cvss4_vuldb_scNNNNN
cvss4_vuldb_siNNNNN
cvss4_vuldb_saNNNNN
cvss2_vuldb_basescore1.01.01.01.01.0
cvss2_vuldb_tempscore0.90.90.90.90.9
cvss3_vuldb_basescore1.81.81.81.81.8
cvss3_vuldb_tempscore1.71.71.71.71.7
cvss3_meta_basescore1.81.81.81.82.5
cvss3_meta_tempscore1.71.71.71.72.5
cvss4_vuldb_bscore1.01.01.01.01.0
cvss4_vuldb_btscore0.30.30.30.30.3
advisory_date1760133600 (10/11/2025)1760133600 (10/11/2025)1760133600 (10/11/2025)1760133600 (10/11/2025)1760133600 (10/11/2025)
price_0day$0-$5k$0-$5k$0-$5k$0-$5k$0-$5k
euvd_idEUVD-2025-33915EUVD-2025-33915EUVD-2025-33915EUVD-2025-33915
cve_nvd_summaryA vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file /etc/shadow of the component Password Handler. Executing manipulation can lead to use of weak hash. The physical device can be targeted for the attack. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file /etc/shadow of the component Password Handler. Executing manipulation can lead to use of weak hash. The physical device can be targeted for the attack. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file /etc/shadow of the component Password Handler. Executing manipulation can lead to use of weak hash. The physical device can be targeted for the attack. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
cvss4_cna_avPPP
cvss4_cna_acHHH
cvss4_cna_atNNN
cvss4_cna_prLLL
cvss4_cna_uiNNN
cvss4_cna_vcLLL
cvss4_cna_viNNN
cvss4_cna_vaNNN
cvss4_cna_scNNN
cvss4_cna_siNNN
cvss4_cna_saNNN
cvss4_cna_bscore111
cvss3_cna_avPPP
cvss3_cna_acHHH
cvss3_cna_prLLL
cvss3_cna_uiNNN
cvss3_cna_sUUU
cvss3_cna_cLLL
cvss3_cna_iNNN
cvss3_cna_aNNN
cvss3_cna_basescore1.81.81.8
cvss2_cna_avLLL
cvss2_cna_acHHH
cvss2_cna_auSSS
cvss2_cna_ciPPP
cvss2_cna_iiNNN
cvss2_cna_aiNNN
cvss2_cna_basescore111
advisory_disputed00
developer_nicknameSyndrome.ImposterSyndrome.Imposter
person_nicknameskelet4r/dead1nfluenceskelet4r/dead1nfluence
software_typeFirmware SoftwareFirmware Software
company_nameSoftware SecuredSoftware Secured
vulnerability_discoverydate1747332000 (05/15/2025)1747332000 (05/15/2025)
person_nameCalvin Star/Julian BCalvin Star/Julian B
company_websitehttps://www.softwaresecured.com/bloghttps://www.softwaresecured.com/blog
vulnerability_historic00
vulnerability_vendorinformdate1750539600 (06/21/2025)1750539600 (06/21/2025)
exploit_wormified00
advisory_confirm_date1751509800 (07/03/2025)1751509800 (07/03/2025)
advisory_falsepositive00
advisory_freeformenThe Furbo Mini device stores the root user password in /etc/shadow using DES-based hashing. DES (Data Encryption Standard) is a deprecated encryption method known to be cryptographically weak due to its Small key size (56-bit), Susceptibility to brute-force attacks and Vulnerability to modern cryptanalysis. Because of this weak encryption, an attacker with access to the device's filesystem (e.g., via UART or firmware extraction) can easily brute-force the root password hash and obtain cleartext credentials using commonly available tools like Hashcat.The Furbo Mini device stores the root user password in /etc/shadow using DES-based hashing. DES (Data Encryption Standard) is a deprecated encryption method known to be cryptographically weak due to its Small key size (56-bit), Susceptibility to brute-force attacks and Vulnerability to modern cryptanalysis. Because of this weak encryption, an attacker with access to the device's filesystem (e.g., via UART or firmware extraction) can easily brute-force the root password hash and obtain cleartext credentials using commonly available tools like Hashcat.
exploit_freeformen1. Extract the contents of /etc/shadow from the device. 2. Save the root password hash to a file named hash.txt. 3. Run the following Hashcat command: hashcat -m 1500 -w 3 -a 3 hash.txt '?a?a?a?a?a?a?a?a'1. Extract the contents of /etc/shadow from the device. 2. Save the root password hash to a file named hash.txt. 3. Run the following Hashcat command: hashcat -m 1500 -w 3 -a 3 hash.txt '?a?a?a?a?a?a?a?a'
cvss3_nvd_avP
cvss3_nvd_acH
cvss3_nvd_prL
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iN
cvss3_nvd_aN
cvss3_nvd_basescore4

◂ ପଛକୁସମୀକ୍ଷାଆହୁରି ଦୂରରେ ▸

Interested in the pricing of exploits?

See the underground prices here!