Dead1Nfluence

An attacker within Bluetooth Low Energy (BLE) range can send commands to Meatmeet devices, leading to a Denial of Service. Specifically, the attacker can issue shutdown, restart, or clear config commands. The 'clear config' command disassociates the device from its user, requiring reconfiguration and preventing updates from the base station until the device is fixed or restarted.

A weakness exists in the UART Interface component of Tomofun Furbo 360 and Furbo Mini. Manipulation of this component can result in insecure storage of sensitive information. The attack requires physical access to the device and is considered difficult to exploit. The exploit has been publicly released.

A security issue has been identified in the Authentication Token Handler component of the Tomofun Furbo Mobile App on Android. The vulnerability involves insecure storage of sensitive information, potentially allowing for exploitation on a physical device. The exploit has been publicly disclosed. The vendor was informed of the issue but did not respond.

A flaw exists in Tomofun Furbo 360 and Furbo Mini due to improper access controls within the GATT Service component. This issue can be exploited from the local network. The exploit is publicly available.

A flaw exists in the HTTP Traffic Handler component of Tomofun Furbo 360 and Furbo Mini. This issue results in improper certificate validation and can be exploited remotely. Exploitation is considered difficult and requires high complexity.

A server-side request forgery condition exists in Tomofun Furbo 360 and Furbo Mini due to manipulation of the file `TF FQDN.json` within the GATT Interface URL Handler component. The attack can be performed remotely and is considered highly complex, with a difficult exploitability. The exploit has been publicly disclosed.

A security flaw exists in Tomofun Furbo 360 and Furbo Mini devices. The issue involves an unknown function within the Root Account Handler component, which, when manipulated, exposes a hard-coded password. An attacker with local access can exploit this flaw, potentially gaining unauthorized control over the device. The exploit has been made public. The complexity of the attack is considered high, and exploitability is described as difficult.

A weakness exists in Tomofun Furbo 360 and Furbo Mini related to password handling. Manipulation of the `/etc/shadow` file, through an unknown `function`, can lead to the use of weak hash values. The attack can be performed on the physical device and requires a high level of complexity, though exploitability is considered difficult. The exploit has been publicly disclosed.

A flaw exists in Tomofun Furbo 360 and Furbo Mini related to the processing of the GATT Service component. Manipulation of the `DeviceToken` argument can lead to information disclosure. The attack is limited to the local network and requires a high degree of complexity, making exploitability difficult. The exploit has been published.