Tomofun — Vulnerabilities & Security Advisories 18

Tomofun develops interactive pet cameras and toys that enable remote monitoring and engagement with pets through mobile applications. Historically, their products have been vulnerable to multiple security issues including remote code execution, cross-site scripting, and privilege escalation vulnerabilities, often stemming from improper input validation and insecure authentication mechanisms. The company has faced scrutiny for security flaws in its cloud infrastructure and mobile apps, with 18 CVEs documented to date, exposing users to potential unauthorized access and device hijacking. These vulnerabilities have allowed attackers to compromise user accounts, view live feeds, and gain control of connected devices, highlighting significant privacy and security risks in their IoT ecosystem.