CVE-2025-11643

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074

Description A security flaw exists in Tomofun Furbo 360 and Furbo Mini devices. The issue involves manipulation of the file /squashfs-root/furbo img within the MQTT Client Certificate component, leading to the exposure of hard-coded credentials. This attack can be initiated remotely and is considered to have high complexity, though exploitation is difficult.

Recommendations Update Furbo 360 to a version later than FB0035 FW 036. Update Furbo Mini to a version later than MC0020 FW 074.