CVE-2025-11649
📋 TL;DR
This vulnerability allows attackers with local access to exploit a hard-coded password in the Root Account Handler component of Tomofun Furbo pet cameras. This could enable unauthorized root access to affected devices. Users of Furbo 360 and Furbo Mini cameras with vulnerable firmware versions are affected.
💻 Affected Systems
- Tomofun Furbo 360
- Tomofun Furbo Mini
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to gain root access, install malware, intercept camera feeds, or use the device as a foothold into the local network.
Likely Case
Local attackers gaining administrative control of the camera device, potentially accessing video feeds or device settings.
If Mitigated
Limited impact due to local-only attack vector and high complexity, with proper network segmentation preventing lateral movement.
🎯 Exploit Status
Exploit requires local access and technical knowledge. Public exploit details available but vendor has not responded to disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor vendor website for firmware updates and apply when released.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Furbo cameras on a separate VLAN or network segment to limit potential lateral movement.
Physical Security Controls
allRestrict physical access to devices and ensure they're in secure locations to prevent local attacks.
🧯 If You Can't Patch
- Replace affected devices with newer models or different brands if security is critical
- Disable unnecessary features and services on the cameras to reduce attack surface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Furbo app settings: Settings > Device Info > Firmware VersionCheck Version:
No CLI command available. Use Furbo mobile app to check firmware version.Verify Fix Applied:
Verify firmware version is above FB0035_FW_036 for Furbo 360 or above MC0020_FW_074 for Furbo Mini📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful root login
- Unusual process execution from root account
Network Indicators:
- Unexpected outbound connections from Furbo devices
- Unusual network traffic patterns from camera IPs
SIEM Query:
source="furbo*" AND (event_type="authentication" AND result="success" AND user="root")