CVE-2025-11642
📋 TL;DR
A denial-of-service vulnerability exists in Tomofun Furbo 360 and Furbo Mini pet cameras through their Registration Handler component. Physical access to the device is required for exploitation, making it primarily a risk for device owners or those with physical proximity. The vulnerability can render the camera unresponsive or non-functional.
💻 Affected Systems
- Tomofun Furbo 360
- Tomofun Furbo Mini
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Device becomes completely inoperable, requiring physical reset or replacement, disrupting pet monitoring capabilities.
Likely Case
Temporary service disruption requiring device reboot, causing monitoring gaps.
If Mitigated
Minimal impact with proper physical security preventing unauthorized access to devices.
🎯 Exploit Status
Exploitation requires physical device access and technical knowledge of the Registration Handler component. No public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Furbo 360: versions after FB0035_FW_036, Furbo Mini: versions after MC0020_FW_074
Vendor Advisory: No vendor advisory available - vendor did not respond to disclosure
Restart Required: No
Instructions:
1. Open Furbo mobile app. 2. Navigate to device settings. 3. Check for firmware updates. 4. Install any available updates. 5. Verify firmware version is above affected ranges.
🔧 Temporary Workarounds
Physical Security Controls
allRestrict physical access to devices to prevent potential exploitation.
Network Segmentation
allIsolate Furbo devices on separate network segments to limit potential attack surface.
🧯 If You Can't Patch
- Implement strict physical access controls to prevent unauthorized device access
- Monitor device availability and have procedures for manual reset if service disruption occurs
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Furbo mobile app: Settings > Device Info > Firmware VersionCheck Version:
No CLI command - use Furbo mobile app: Settings > Device InfoVerify Fix Applied:
Confirm firmware version is above affected ranges: Furbo 360 > FB0035_FW_036, Furbo Mini > MC0020_FW_074📡 Detection & Monitoring
Log Indicators:
- Device registration failures
- Unexpected device reboots
- Service interruption alerts
Network Indicators:
- Device going offline unexpectedly
- Unusual physical access patterns to device location
SIEM Query:
No standard SIEM query - monitor for device offline alerts and physical access logs