Tomofun Furbo 360/Furbo Mini Registration सेवा नाकारली

एक असुरक्षितता जी समस्याग्रस्त म्हणून वर्गीकृत आहे, ती Tomofun Furbo 360 and Furbo Mini मध्ये आढळली आहे. प्रभावित आहे अज्ञात फंक्शन घटक Registration Handler च्या. सॉफ्टवेअरमध्ये केलेली छेडछाड सेवा नाकारली निर्माण करते. CWE वापरून समस्या घोषित केल्याने CWE-404 कडे नेले जाते. हा दोष 15/05/2025 रोजी आढळला. कमजोरी प्रकाशित करण्यात आली होती 11/10/2025 द्वारा Calvin Star, Julian B (skelet4r and dead1nfluence) सह Software Secured. ही असुरक्षा CVE-2025-11642 म्हणून नोंदवली गेली आहे. फिजिकल डिव्हाइसवर हल्ला सुरू करणे शक्य आहे. तांत्रिक तपशील उपलब्ध नाहीत. यासाठी एक एक्स्प्लॉइट उपलब्ध आहे. सध्याच्या घडीला अंदाजे USD $0-$5k असू शकतो. हे प्रूफ-ऑफ-कॉन्सेप्ट म्हणून घोषित केले आहे. कमीत कमी 148 दिवसांसाठी ही दुर्बलता सार्वजनिक नसलेल्या झिरो-डे शोषण म्हणून हाताळली गेली होती. 0-डे म्हणून अंदाजे अंडरग्राउंड किंमत सुमारे $0-$5k होती. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

5 बदल · 105 डेटा पॉइंट्स

शेततयार केली
11/10/2025 08:38 PM
अद्ययावत 1/4
12/10/2025 10:51 PM
अद्ययावत 2/4
12/10/2025 11:14 PM
अद्ययावत 3/4
18/10/2025 09:14 AM
अद्ययावत 4/4
18/10/2025 09:17 AM
software_vendorTomofunTomofunTomofunTomofunTomofun
software_nameFurbo 360/Furbo MiniFurbo 360/Furbo MiniFurbo 360/Furbo MiniFurbo 360/Furbo MiniFurbo 360/Furbo Mini
software_componentRegistration HandlerRegistration HandlerRegistration HandlerRegistration HandlerRegistration Handler
vulnerability_cweCWE-404 (सेवा नाकारली)CWE-404 (सेवा नाकारली)CWE-404 (सेवा नाकारली)CWE-404 (सेवा नाकारली)CWE-404 (सेवा नाकारली)
vulnerability_risk11111
cvss3_vuldb_avPPPPP
cvss3_vuldb_acHHHHH
cvss3_vuldb_prLLLLL
cvss3_vuldb_uiNNNNN
cvss3_vuldb_sUUUUU
cvss3_vuldb_cNNNNN
cvss3_vuldb_iNNNNN
cvss3_vuldb_aHHHHH
source_cveCVE-2025-11642CVE-2025-11642CVE-2025-11642CVE-2025-11642CVE-2025-11642
cna_responsibleVulDBVulDBVulDBVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
decision_summaryThe firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.
cvss2_vuldb_avLLLLL
cvss2_vuldb_acHHHHH
cvss2_vuldb_ciNNNNN
cvss2_vuldb_iiNNNNN
cvss2_vuldb_aiCCCCC
cvss4_vuldb_avPPPPP
cvss4_vuldb_acHHHHH
cvss4_vuldb_prLLLLL
cvss4_vuldb_uiNNNNN
cvss4_vuldb_vcNNNNN
cvss4_vuldb_viNNNNN
cvss4_vuldb_vaHHHHH
cvss2_vuldb_auSSSSS
cvss2_vuldb_eNDNDNDNDPOC
cvss2_vuldb_rlNDNDNDNDND
cvss2_vuldb_rcNDNDNDNDND
cvss3_vuldb_eXXXXP
cvss3_vuldb_rlXXXXX
cvss3_vuldb_rcXXXXX
cvss4_vuldb_atNNNNN
cvss4_vuldb_scNNNNN
cvss4_vuldb_siNNNNN
cvss4_vuldb_saNNNNN
cvss4_vuldb_eXXXXX
cvss2_vuldb_basescore3.83.83.83.83.8
cvss2_vuldb_tempscore3.83.83.83.83.8
cvss3_vuldb_basescore4.04.04.04.04.0
cvss3_vuldb_tempscore4.04.04.04.03.8
cvss3_meta_basescore4.04.04.04.04.0
cvss3_meta_tempscore4.04.04.04.03.9
cvss4_vuldb_bscore4.14.14.14.14.1
cvss4_vuldb_btscore4.14.14.14.11.5
advisory_date1760133600 (11/10/2025)1760133600 (11/10/2025)1760133600 (11/10/2025)1760133600 (11/10/2025)1760133600 (11/10/2025)
price_0day$0-$5k$0-$5k$0-$5k$0-$5k$0-$5k
euvd_idEUVD-2025-33907EUVD-2025-33907EUVD-2025-33907EUVD-2025-33907
cve_nvd_summaryA vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation leads to denial of service. The attack can be executed directly on the physical device. The attack requires a high level of complexity. The exploitability is told to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation leads to denial of service. The attack can be executed directly on the physical device. The attack requires a high level of complexity. The exploitability is told to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation leads to denial of service. The attack can be executed directly on the physical device. The attack requires a high level of complexity. The exploitability is told to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
cvss4_cna_avPPP
cvss4_cna_acHHH
cvss4_cna_atNNN
cvss4_cna_prLLL
cvss4_cna_uiNNN
cvss4_cna_vcNNN
cvss4_cna_viNNN
cvss4_cna_vaHHH
cvss4_cna_scNNN
cvss4_cna_siNNN
cvss4_cna_saNNN
cvss4_cna_bscore4.14.14.1
cvss3_cna_avPPP
cvss3_cna_acHHH
cvss3_cna_prLLL
cvss3_cna_uiNNN
cvss3_cna_sUUU
cvss3_cna_cNNN
cvss3_cna_iNNN
cvss3_cna_aHHH
cvss3_cna_basescore444
cvss2_cna_avLLL
cvss2_cna_acHHH
cvss2_cna_auSSS
cvss2_cna_ciNNN
cvss2_cna_iiNNN
cvss2_cna_aiCCC
cvss2_cna_basescore3.83.83.8
advisory_disputed00
exploit_publicity00
vulnerability_discoverydate1747332000 (15/05/2025)1747332000 (15/05/2025)
company_websitehttps://www.softwaresecured.com/bloghttps://www.softwaresecured.com/blog
exploit_availability11
advisory_confirm_date1751509800 (03/07/2025)1751509800 (03/07/2025)
exploit_wormified00
person_nameCalvin Star/Julian BCalvin Star/Julian B
company_nameSoftware SecuredSoftware Secured
exploit_languageBashBash
advisory_falsepositive00
vulnerability_vendorinformdate1750539600 (21/06/2025)1750539600 (21/06/2025)
vulnerability_historic00
advisory_freeformenAn attacker with physical access to a Furbo device can spoof the DeviceID of a victim’s unregistered device and complete the registration process for that DeviceID. Once the registration process is completed the Victim's DeviceID is bound to the Attackers Account. This results in a denial of service for the victim as they are then unable to register or use the device associated with that DeviceID.An attacker with physical access to a Furbo device can spoof the DeviceID of a victim’s unregistered device and complete the registration process for that DeviceID. Once the registration process is completed the Victim's DeviceID is bound to the Attackers Account. This results in a denial of service for the victim as they are then unable to register or use the device associated with that DeviceID.
exploit_freeformenReplication Steps: 1. Modify the factory config file located in /mnt/hw/factory.json to include the MAC address and BTMAC address 2. Replace the MAC address specified within the factory.json file with the Victim's MAC Address 3. Remove the device configuration file located in /mnt/flash/furbo/setup_info.json 4. Reboot the Furbo 5. Complete the registration process of the Furbo in the mobile app 6. Observe the Victim DeviceID associated with your accountReplication Steps: 1. Modify the factory config file located in /mnt/hw/factory.json to include the MAC address and BTMAC address 2. Replace the MAC address specified within the factory.json file with the Victim's MAC Address 3. Remove the device configuration file located in /mnt/flash/furbo/setup_info.json 4. Reboot the Furbo 5. Complete the registration process of the Furbo in the mobile app 6. Observe the Victim DeviceID associated with your account
software_typeFirmware SoftwareFirmware Software
person_nicknameskelet4r/dead1nfluenceskelet4r/dead1nfluence
developer_nicknameSkelet4rSkelet4r
developer_nameCalvin StarCalvin Star

Want to stay up to date on a daily basis?

Enable the mail alert feature now!