A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The attack is considered to have high complexity. The exploitability is said to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

Attack Vector Physical

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Physical

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Physical

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Tomofun
  • Furbo 360
  • Furbo Mini

No data.

No data.

References
Link Providers
https://vuldb.com/?ctiid.328052 cve-icon cve-icon
https://vuldb.com/?id.328052 cve-icon cve-icon
https://vuldb.com/?submit.661379 cve-icon cve-icon
History

Thu, 23 Oct 2025 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Tomofun
Tomofun furbo 360
Tomofun furbo Mini
Vendors & Products Tomofun
Tomofun furbo 360
Tomofun furbo Mini

Fri, 17 Oct 2025 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV2_0

{'score': 3.7, 'vector': 'AV:L/AC:H/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:ND'}

cvssV3_0

{'score': 3.9, 'vector': 'CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X'}

cvssV3_1

{'score': 3.9, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X'}

 cvssV2_0

{'score': 3.7, 'vector': 'AV:L/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:ND'}

cvssV3_0

{'score': 3.9, 'vector': 'CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:X'}

cvssV3_1

{'score': 3.9, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:X'}

Tue, 14 Oct 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 12 Oct 2025 18:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The attack is considered to have high complexity. The exploitability is said to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Title Tomofun Furbo 360/Furbo Mini Trial Restriction access control
Weaknesses CWE-266
CWE-284
References
Metrics cvssV2_0

{'score': 3.7, 'vector': 'AV:L/AC:H/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:ND'}

cvssV3_0

{'score': 3.9, 'vector': 'CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X'}

cvssV3_1

{'score': 3.9, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X'}

cvssV4_0

{'score': 1, 'vector': 'CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2025-10-17T05:49:10.328Z

Reserved: 2025-10-11T18:32:47.228Z

Link: CVE-2025-11641

cve-icon Vulnrichment

Updated: 2025-10-14T14:59:48.817Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-12T19:15:35.283

Modified: 2025-10-14T19:36:59.730

Link: CVE-2025-11641

cve-icon Redhat

No data.