CVE-2025-11647 LOW

CVE-2025-11647: Tomofun Furbo 360/Furbo Mini GATT Service information disclosure

Vendor Tomofun
Product Furbo 360
Weakness CWE-200 · Info exposure
Published October 12, 2025
Last update October 18, 2025
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the argument DeviceToken causes information disclosure. The attack is only possible within the local network. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

October 12, 2025 CVE published
October 18, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-7542 Slider Revolution <= 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure CVE-2026-49355 OpenProject: Private work package data disclosure through single meeting agenda item API CVE-2026-44206 Frappe: DB Schema Enumeration via Frappe-Authorization-Source CVE-2026-42972 Windows Hyper-V Information Disclosure Vulnerability CVE-2026-47340 Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.