CVE-2025-11633— Tomofun Furbo 360/Furbo Mini HTTP Traffic collect_logs.sh upload_file_to_s3 certificate validation
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-11633
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tomofun Furbo 360/Furbo Mini HTTP Traffic collect_logs.sh upload_file_to_s3 certificate validation
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the component HTTP Traffic Handler. The manipulation leads to improper certificate validation. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
证书验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Tomofun Furbo 360和Tomofun Furbo Mini 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tomofun Furbo 360和Tomofun Furbo Mini都是中国台湾Tomofun公司的一款智能宠物摄像机。 Tomofun Furbo 360 FB0035_FW_036及之前版本和Tomofun Furbo Mini MC0020_FW_074及之前版本存在信任管理问题漏洞，该漏洞源于HTTP Traffic Handler组件证书验证不当，可能导致远程攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Tomofun | Furbo 360 | n/a | - | |
| Tomofun | Furbo Mini | n/a | - |
II. Public POCs for CVE-2025-11633
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-11633
请登录查看更多情报信息。
Same Patch Batch · Tomofun · 2025-10-12 · 18 CVEs total
| CVE-2025-11649 | 7.0 HIGH | Tomofun Furbo 360/Furbo Mini Root Account hard-coded password |
| CVE-2025-11646 | 6.3 MEDIUM | Tomofun Furbo 360/Furbo Mini GATT Service access control |
| CVE-2025-11636 | 5.6 MEDIUM | Tomofun Furbo 360 Account server-side request forgery |
| CVE-2025-11648 | 5.6 MEDIUM | Tomofun Furbo 360/Furbo Mini GATT Interface URL TF_FQDN.json server-side request forgery |
| CVE-2025-11635 | 4.3 MEDIUM | Tomofun Furbo 360 File Upload resource consumption |
| CVE-2025-11637 | 4.3 MEDIUM | Tomofun Furbo 360 Audio race condition |
| CVE-2025-11638 | 4.3 MEDIUM | Tomofun Furbo 360/Furbo Mini Bluetooth denial of service |
| CVE-2025-11642 | 4.0 MEDIUM | Tomofun Furbo 360/Furbo Mini Registration denial of service |
| CVE-2025-11641 | 3.9 LOW | Tomofun Furbo 360/Furbo Mini Trial Restriction access control |
| CVE-2025-11643 | 3.7 LOW | Tomofun Furbo 360/Furbo Mini MQTT Client Certificate furbo_img hard-coded credentials |
| CVE-2025-11639 | 3.3 LOW | Tomofun Furbo 360/Furbo Mini Debug Log S3 Bucket collect_logs.sh sensitive information |
| CVE-2025-11640 | 3.1 LOW | Tomofun Furbo 360/Furbo Mini Bluetooth Low Energy cleartext transmission |
| CVE-2025-11647 | 3.1 LOW | Tomofun Furbo 360/Furbo Mini GATT Service information disclosure |
| CVE-2025-11634 | 2.4 LOW | Tomofun Furbo 360/Furbo Mini UART information disclosure |
| CVE-2025-11645 | 2.4 LOW | Tomofun Furbo Mobile App Authentication Token sensitive information |
| CVE-2025-11644 | 2.0 LOW | Tomofun Furbo 360/Furbo Mini UART sensitive information |
| CVE-2025-11650 | 1.8 LOW | Tomofun Furbo 360/Furbo Mini Password shadow weak hash |
IV. Related Vulnerabilities
Same product: Furbo 360
- CVE-2025-11650
Tomofun Furbo 360/Furbo Mini Password shadow weak hash - CVE-2025-11649
Tomofun Furbo 360/Furbo Mini Root Account hard-coded passwor - CVE-2025-11648
Tomofun Furbo 360/Furbo Mini GATT Interface URL TF_FQDN.json - CVE-2025-11647
Tomofun Furbo 360/Furbo Mini GATT Service information disclo - CVE-2025-11646
Tomofun Furbo 360/Furbo Mini GATT Service access control
Same vendor: Tomofun
- CVE-2025-11650
Tomofun Furbo 360/Furbo Mini Password shadow weak hash - CVE-2025-11649
Tomofun Furbo 360/Furbo Mini Root Account hard-coded passwor - CVE-2025-11648
Tomofun Furbo 360/Furbo Mini GATT Interface URL TF_FQDN.json - CVE-2025-11647
Tomofun Furbo 360/Furbo Mini GATT Service information disclo - CVE-2025-11646
Tomofun Furbo 360/Furbo Mini GATT Service access control
Same weakness: CWE-295
V. Comments for CVE-2025-11633
No comments yet