CVE-2025-11646
📋 TL;DR
This vulnerability allows attackers on the same local network to bypass access controls in Tomofun Furbo pet cameras via the GATT Service, potentially accessing sensitive device information. It affects Furbo 360 and Furbo Mini devices with vulnerable firmware versions. The exploit is publicly available, increasing the risk for affected devices.
💻 Affected Systems
- Tomofun Furbo 360
- Tomofun Furbo Mini
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive device data, potentially enabling further attacks or compromising pet monitoring functionality.
Likely Case
Unauthorized access to device information and potential disruption of normal camera operations.
If Mitigated
Limited impact with proper network segmentation and access controls in place.
🎯 Exploit Status
Exploit requires local network access and knowledge of Bluetooth GATT service manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor did not respond to disclosure
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates if they become available.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Furbo devices on separate VLAN or network segment to limit attack surface
Disable Unnecessary Services
allIf possible, disable Bluetooth/GATT services not required for operation
🧯 If You Can't Patch
- Segment Furbo devices on isolated network away from other critical systems
- Monitor network traffic for unusual Bluetooth/GATT service access patterns
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in Furbo mobile app: Settings > Device Info > Firmware VersionCheck Version:
No CLI command - use Furbo mobile app interfaceVerify Fix Applied:
Verify firmware version is above FB0035_FW_036 for Furbo 360 or MC0020_FW_074 for Furbo Mini📡 Detection & Monitoring
Log Indicators:
- Unusual Bluetooth connection attempts
- Multiple failed GATT service access attempts
Network Indicators:
- Unexpected Bluetooth traffic to Furbo devices
- GATT service enumeration attempts
SIEM Query:
No standard SIEM query available - monitor for Bluetooth service enumeration patterns