{"id":"CVE-2025-11634","state":"PUBLISHED","title":"Tomofun Furbo 360/Furbo Mini UART information disclosure","description":"A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results in information disclosure. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-10-12T12:32:04.763Z","updatedAt":"2025-10-16T17:39:41.035Z","severity":{"score":2.4,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X","source":"VulDB"},"assigner":"VulDB","products":["Tomofun Furbo 360","Tomofun Furbo Mini"],"affected":[{"vendor":"Tomofun","product":"Furbo 360","versions":[{"version":"n/a","status":"affected"}],"modules":["UART Interface"]},{"vendor":"Tomofun","product":"Furbo Mini","versions":[{"version":"n/a","status":"affected"}],"modules":["UART Interface"]}],"references":["https://vuldb.com/?id.328045","https://vuldb.com/?ctiid.328045","https://vuldb.com/?submit.661353"],"weaknesses":["CWE-200","CWE-284"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/11xxx/CVE-2025-11634.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-11634","state":"PUBLISHED","datePublished":"2025-10-12T12:32:04.763Z","dateUpdated":"2025-10-16T17:39:41.035Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-10-11T18:32:22.501Z"},"containers":{"cna":{"title":"Tomofun Furbo 360/Furbo Mini UART information disclosure","descriptions":[{"lang":"en","value":"A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results in information disclosure. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Es wurde eine Schwachstelle in Tomofun Furbo 360 and Furbo Mini entdeckt. Dabei geht es um eine nicht genauer bekannte Funktion der Komponente UART Interface. Die Manipulation führt zu information disclosure. Ein Angriff auf das physische Gerät kann durchgeführt werden. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"Tomofun","product":"Furbo 360","versions":[{"version":"n/a","status":"affected"}],"modules":["UART Interface"]},{"vendor":"Tomofun","product":"Furbo Mini","versions":[{"version":"n/a","status":"affected"}],"modules":["UART Interface"]}],"references":[{"url":"https://vuldb.com/?id.328045","name":"VDB-328045 | Tomofun Furbo 360/Furbo Mini UART information disclosure","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.328045","name":"VDB-328045 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.661353","name":"Submit #661353 | Tomofun Furbo 360, Furbo Mini Furbo 360 (≤ FB0035_FW_036), Furbo Mini (≤ MC0020_FW_074) Insertion of Sensitive Information into Log File","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":2.4,"vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X","baseSeverity":"LOW"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":2.1,"vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","type":"CWE","lang":"en","description":"Information Disclosure"}]},{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-10-13T20:34:02.619Z"},"timeline":[{"time":"2025-05-15T20:00:00.000Z","lang":"en","value":"Vulnerability found"},{"time":"2025-06-21T23:00:00.000Z","lang":"en","value":"Vendor informed"},{"time":"2025-07-03T04:30:00.000Z","lang":"en","value":"Vendor acknowledged"},{"time":"2025-10-11T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-10-11T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-10-13T22:38:58.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Calvin Star (Software Secured)","type":"finder"},{"lang":"en","value":"Julian B (Software Secured)","type":"finder"},{"lang":"en","value":"jTag Labs (VulDB User)","type":"reporter"},{"lang":"en","value":"jTag Labs (VulDB User)","type":"analyst"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-16T17:37:49.877191Z","id":"CVE-2025-11634","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-16T17:39:41.035Z"}}]}}}