Insecure Password Handling in Tomofun Furbo Devices
CVE-2025-11650

1LOW

Key Information:

Vendor

Tomofun

Status
Furbo 360
Furbo Mini
Vendor
CVE Published:
12 October 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-11650?

The vulnerability in Tomofun's Furbo 360 and Furbo Mini devices is related to a flaw in the Password Handler component concerning insufficiently secured passwords. The issue lies in the manipulation of the /etc/shadow file, where an insecure hashing mechanism exposes the devices to potential attacks. Although exploiting this vulnerability requires a significant level of complexity, its public disclosure raises concerns regarding the security posture of the affected firmware versions. Users should be aware that the vendor has not provided a response to the reported issue.

Affected Version(s)

Furbo 360

Furbo Mini

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-11650 - Proof of Concept

References

https://vuldb.com/?id.328061
vdb-entrytechnical-description
https://vuldb.com/?ctiid.328061
signaturepermissions-required
https://vuldb.com/?submit.662771
third-party-advisory

CVSS V4

Score:
1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Physical
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

jTag Labs (VulDB User)
JSON
.