CVE-2025-11634

Executive Summary

CVE-2025-11634 discloses a physical information disclosure vulnerability in Tomofun Furbo 360 and Furbo Mini pet cameras. The flaw resides in the UART (Universal Asynchronous Receiver-Transmitter) interface, which is a physical debug port typically used for firmware development and diagnostics. An attacker with physical access to the device can connect to this UART interface and extract sensitive information, including firmware binaries, configuration data, and potentially credentials or encryption keys. The vendor, Tomofun, has been unresponsive, and no official patch is available. The exploit has been publicly released, increasing the risk for owners of these devices.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a hardware-level issue in a consumer IoT device. The supply chain risk is limited to the physical device itself and its firmware distribution.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Base Score: 4.6) Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Physical (P) – The attacker must have physical access to the device.
• Attack Complexity (AC): Low (L) – The UART interface is often exposed on PCB headers or test points.
• Privileges Required (PR): None (N) – No authentication needed to access the UART console.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the device itself.
• Confidentiality (C): High (H) – Full disclosure of firmware and sensitive data.
• Integrity (I): None (N) – No data modification possible via this vector.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While physical access is required, the exploit is trivial and publicly available. The lack of a patch makes all affected devices permanently vulnerable.

Deep Dive & Mechanics

The UART interface is a standard serial communication protocol used for debugging and firmware flashing. On the Furbo 360 and Furbo Mini, this interface is exposed on the main circuit board, often via a 4-pin header (VCC, GND, TX, RX). The vulnerability arises because the UART console is enabled in the production firmware without authentication or access control.

Technical Details:

1. Physical Access: The attacker must open the device casing (typically using a plastic pry tool or screwdriver) to access the PCB.
2. UART Connection: Using a USB-to-UART adapter (e.g., FTDI, CP2102), the attacker connects to the TX, RX, and GND pins. Common baud rates are 115200 or 57600.
3. Console Access: Upon connection, the device may present a bootloader prompt (e.g., U-Boot) or a Linux shell. No password is required.
4. Information Disclosure: From the console, the attacker can:
   • Dump the entire firmware via cat /dev/mtdblock0 or similar.
   • Read configuration files (e.g., /etc/config/wireless, /etc/shadow).
   • Extract Wi-Fi credentials, cloud API keys, or encryption certificates.
   • Access the device's file system and memory.

Root Cause: The vendor left the UART debug interface enabled and unauthenticated in the production firmware. This is a common oversight in IoT device development.

Vulnerable vs. Patched Code

Since no patch exists, there is no patched code to compare. The vulnerable code is the firmware itself, which includes the UART console initialization. A hypothetical patch would involve:

• Vulnerable: UART console enabled with no authentication.
• Patched: UART console disabled in production firmware, or protected by a password prompt.

Example of vulnerable initialization (pseudo-code):

// In bootloader or kernel config
console=ttyS0,115200n8
// No authentication check

Hypothetical patched code:

// Disable UART console in production
console=null
// Or add authentication
if (authenticate_user() == FAIL) {
    while(1);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Physical access to the Furbo device.
• USB-to-UART adapter (e.g., FTDI FT232RL).
• Serial terminal software (e.g., PuTTY, screen, minicom).
• Screwdriver and plastic pry tool.

Steps:

1. Disassemble the device: Remove the rubber base and unscrew the casing to access the PCB.
2. Identify UART pins: Look for a 4-pin header labeled "UART", "J1", or similar. Use a multimeter to confirm GND (0V), VCC (3.3V), TX (3.3V idle), and RX.
3. Connect the adapter:
   • GND to GND
   • TX (device) to RX (adapter)
   • RX (device) to TX (adapter)
   • Do not connect VCC to avoid power conflicts.
4. Open serial terminal: Configure 115200 baud, 8 data bits, no parity, 1 stop bit.
5. Power on the device: You should see boot messages and a shell prompt (e.g., # or $).
6. Extract data:

   # Dump firmware
   cat /dev/mtdblock0 > /tmp/firmware.bin
   # Read config
   cat /etc/config/wireless
   # List processes
   ps aux
   

Example exploit script (Python):

import serial
import time

ser = serial.Serial('/dev/ttyUSB0', 115200, timeout=1)
time.sleep(2)
ser.write(b'cat /etc/config/wireless\n')
time.sleep(1)
print(ser.read(1000).decode())
ser.close()

Blue Team (Defense & Detection)

Detection:

• Physical inspection: Check for signs of tampering (scratches, opened casing).
• Network monitoring: Unusual serial traffic over USB (if device is connected to a host).
• Firmware integrity: Compare firmware hash against known good version.

Mitigation:

• Physical security: Place the device in a locked enclosure.
• Firmware hardening: Request vendor to release a patch disabling UART.
• Network segmentation: Isolate IoT devices on a separate VLAN.

Indicators of Compromise (IOCs)

Physical IOCs:

• Opened device casing or missing screws.
• Soldering flux or wire connections on UART header.
• USB-to-UART adapter connected to the device.

Digital IOCs:

• Unauthorized firmware dump (e.g., firmware.bin on attacker's system).
• Serial console logs containing commands like cat /dev/mtdblock0.
• Network traffic from the device to an unknown IP (if attacker exfiltrates data).

File Hashes (example, not actual):

• Firmware MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
• Config file MD5: f1e2d3c4b5a6978876f5e4d3c2b1a0f9

Detection Engineering

YARA Rule

rule CVE_2025_11634_UART_Disclosure {
    meta:
        description = "Detects firmware images with UART console enabled"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11634"
    strings:
        $uart1 = "console=ttyS0" ascii wide
        $uart2 = "115200n8" ascii wide
        $uart3 = "ttyAMA0" ascii wide
    condition:
        any of ($uart*)
}

Sigma Rule

title: CVE-2025-11634 UART Information Disclosure
id: 8f9a2b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to access UART console on Tomofun Furbo devices
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: shell
detection:
    selection:
        CommandLine|contains:
            - 'cat /dev/mtdblock'
            - 'cat /etc/config/wireless'
            - 'cat /etc/shadow'
    condition: selection
falsepositives:
    - Legitimate debugging by authorized personnel
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11634 UART Data Exfiltration"; flow:to_server; content:"firmware.bin"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Physical security: Place the device in a locked area or enclosure to prevent physical access.
2. Network isolation: Place the Furbo on a separate VLAN with no access to critical systems.
3. Monitor for tampering: Regularly inspect the device for signs of physical intrusion.

Long-term Solutions:

1. Vendor patch: Contact Tomofun and demand a firmware update that disables the UART console in production mode.
2. Firmware hardening: If possible, reflash the device with custom firmware that disables UART.
3. Device replacement: Consider replacing the device with a more secure alternative if no patch is forthcoming.

Workaround:

• If you have soldering skills, you can physically disconnect the UART header by removing the resistor or cutting the trace on the PCB. This is irreversible and may void warranty.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert