{"id":"CVE-2025-11645","state":"PUBLISHED","title":"Tomofun Furbo Mobile App Authentication Token sensitive information","description":"A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical device. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-10-12T20:32:05.707Z","updatedAt":"2025-10-18T21:27:53.120Z","severity":{"score":2.4,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Tomofun Furbo Mobile App"],"affected":[{"vendor":"Tomofun","product":"Furbo Mobile App","versions":[{"version":"7.57.0a","status":"affected"}],"modules":["Authentication Token Handler"]}],"references":["https://vuldb.com/?id.328056","https://vuldb.com/?ctiid.328056","https://vuldb.com/?submit.661899","https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.md"],"weaknesses":["CWE-922","CWE-200"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/11xxx/CVE-2025-11645.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-11645","state":"PUBLISHED","datePublished":"2025-10-12T20:32:05.707Z","dateUpdated":"2025-10-18T21:27:53.120Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-10-11T18:32:59.727Z"},"containers":{"cna":{"title":"Tomofun Furbo Mobile App Authentication Token sensitive information","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical device. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Eine Schwachstelle wurde in Tomofun Furbo Mobile App up to 7.57.0a auf Android gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Komponente Authentication Token Handler. Durch Manipulieren mit unbekannten Daten kann eine insecure storage of sensitive information-Schwachstelle ausgenutzt werden. Der Angriff auf das physische Gerät ist möglich. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden."}],"affected":[{"vendor":"Tomofun","product":"Furbo Mobile App","versions":[{"version":"7.57.0a","status":"affected"}],"modules":["Authentication Token Handler"]}],"references":[{"url":"https://vuldb.com/?id.328056","name":"VDB-328056 | Tomofun Furbo Mobile App Authentication Token sensitive information","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.328056","name":"VDB-328056 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.661899","name":"Submit #661899 | Tomofun Furbo Mobile Application ≤ 7.57.0a Insecure Storage of Sensitive Information","tags":["third-party-advisory"]},{"url":"https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":2.4,"vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"LOW"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":2.1,"vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-922","type":"CWE","lang":"en","description":"Insecure Storage of Sensitive Information"}]},{"descriptions":[{"cweId":"CWE-200","type":"CWE","lang":"en","description":"Information Disclosure"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-10-18T21:27:53.120Z"},"timeline":[{"time":"2025-05-15T20:00:00.000Z","lang":"en","value":"Vulnerability found"},{"time":"2025-06-21T23:00:00.000Z","lang":"en","value":"Vendor informed"},{"time":"2025-07-03T04:30:00.000Z","lang":"en","value":"Vendor acknowledged"},{"time":"2025-10-11T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-10-11T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-10-18T23:29:56.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Calvin Star (Software Secured)","type":"finder"},{"lang":"en","value":"Julian B (Software Secured)","type":"finder"},{"lang":"en","value":"jTag Labs (VulDB User)","type":"reporter"},{"lang":"en","value":"jTag Labs (VulDB User)","type":"analyst"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-14T14:02:33.489954Z","id":"CVE-2025-11645","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-14T14:02:48.601Z"}}]}}}