Tomofun Furbo 360/Furbo Mini Bluetooth denial of service
Summary
A vulnerability, which was classified as problematic, has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the component Bluetooth Handler. The manipulation leads to denial of service. This vulnerability is traded as CVE-2025-11638. Access to the local network is required for this attack to succeed. Furthermore, there is an exploit available. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Details
A vulnerability was found in Tomofun Furbo 360 and Furbo Mini (Firmware Software) (affected version unknown). It has been rated as problematic. This issue affects an unknown functionality of the component Bluetooth Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.
The bug was discovered 05/15/2025. The weakness was shared by Calvin Star, Julian B (skelet4r and dead1nfluence) with Software Secured. An attacker within Bluetooth range of a Furbo device can connect to the device and issues a command to an exposed GATT characteristic. This command can put the Furbo device into a soft reset state where it will disconnect from it's associated WiFi network and only reconnect after being power cycled manually. The identification of this vulnerability is CVE-2025-11638. The exploitation is known to be easy. The attack can only be done within the local network. No form of authentication is needed for a successful exploitation. Technical details are unknown but a private exploit is available.
A private exploit has been developed by Julian B (dead1nfluence) in Python. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 149 days. During that time the estimated underground price was around . The vendor was contacted early about this disclosure but did not respond in any way. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. 1. Create a basic python script utilizing bleak in order to connect to devices over BLE and interact with exposed GATT characteristics 2. Run the script and connect to the Furbo 3. Write data to the exposed characteristic 4. Observer the Furbo status light change and become unusable until restarted
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-33903). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Type
Vendor
Name
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CNA CVSS-B Score: 🔒
CNA CVSS-BT Score: 🔒
CNA Vector: 🔒
CVSSv3
VulDB Meta Base Score: 5.0VulDB Meta Temp Score: 5.0
VulDB Base Score: 4.3
VulDB Temp Score: 4.1
VulDB Vector: 🔒
VulDB Reliability: 🔍
NVD Base Score: 6.5
NVD Vector: 🔒
CNA Base Score: 4.3
CNA Vector: 🔒
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Denial of serviceCWE: CWE-404
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Partially
Availability: 🔒
Access: Private
Status: Proof-of-Concept
Author: Julian B (dead1nfluence)
Programming Language: 🔒
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔒
Timeline
05/15/2025 Vulnerability found06/21/2025 Vendor informed
07/03/2025 Vendor acknowledged
10/11/2025 Advisory disclosed
10/11/2025 VulDB entry created
10/31/2025 VulDB entry last update
Sources
Researcher: Calvin Star, Julian B (skelet4r, dead1nfluence)Organization: Software Secured
Status: Not defined
CVE: CVE-2025-11638 (🔒)
GCVE (CVE): GCVE-0-2025-11638
GCVE (VulDB): GCVE-100-328049
EUVD: 🔒
scip Labs: https://www.scip.ch/en/?labs.20161013
Entry
Created: 10/11/2025 20:38Updated: 10/31/2025 05:43
Changes: 10/11/2025 20:38 (51), 10/12/2025 20:06 (1), 10/12/2025 20:18 (29), 10/16/2025 07:41 (14), 10/16/2025 07:42 (4), 10/16/2025 07:44 (5), 10/31/2025 05:43 (12)
Complete: 🔍
Submitter: jTag Labs
Committer: jTag Labs
Cache ID: 216::103
Submit
Accepted
- Submit #661363: Tomofun Furbo 360, Furbo Mini Furbo 360 (≤ FB0035_FW_036), Furbo Mini (≤ MC0020_FW_074) Denial of Service (by jTag Labs)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.