Furbo Mini Firmware vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Latest Furbo Mini Firmware vulnerabilities

CVE-2025-11650 — Tomofun Furbo 360/Furbo Mini Password shadow weak hash (CVSS 4.0)
CVE-2025-11649 — Tomofun Furbo 360/Furbo Mini Root Account hard-coded password (CVSS 6.3)
CVE-2025-11648 — Tomofun Furbo 360/Furbo Mini GATT Interface URL TF_FQDN.json server-side request forgery (CVSS 7.4)
CVE-2025-11647 — Tomofun Furbo 360/Furbo Mini GATT Service information disclosure (CVSS 6.8)
CVE-2025-11646 — Tomofun Furbo 360/Furbo Mini GATT Service access control (CVSS 8.1)
CVE-2025-11644 — Tomofun Furbo 360/Furbo Mini UART sensitive information (CVSS 4.2)
CVE-2025-11643 — Tomofun Furbo 360/Furbo Mini MQTT Client Certificate furbo_img hard-coded credentials (CVSS 8.1)
CVE-2025-11642 — Tomofun Furbo 360/Furbo Mini Registration denial of service (CVSS 4.0)
CVE-2025-11641 — Tomofun Furbo 360/Furbo Mini Trial Restriction access control (CVSS 6.4)
CVE-2025-11640 — Tomofun Furbo 360/Furbo Mini Bluetooth Low Energy cleartext transmission (CVSS 5.3)
CVE-2025-11639 — Tomofun Furbo 360/Furbo Mini Debug Log S3 Bucket collect_logs.sh sensitive information (CVSS 5.5)
CVE-2025-11638 — Tomofun Furbo 360/Furbo Mini Bluetooth denial of service (CVSS 6.5)
CVE-2025-11634 — Tomofun Furbo 360/Furbo Mini UART information disclosure (CVSS 4.6)
CVE-2025-11633 — Tomofun Furbo 360/Furbo Mini HTTP Traffic collect_logs.sh upload_file_to_s3 certificate validation (CVSS 5.9)