CVE-2025-11644

Executive Summary

CVE-2025-11644 identifies a physical security weakness in Tomofun Furbo 360 and Furbo Mini pet cameras. The vulnerability resides in the UART (Universal Asynchronous Receiver-Transmitter) interface, which is exposed on the device’s hardware. An attacker with physical access to the device can exploit this interface to extract sensitive information stored insecurely on the firmware. The attack requires high complexity and physical proximity, resulting in a low CVSS score of 2.0. The vendor has not responded to disclosure attempts, and no patch is currently available. This report provides a comprehensive analysis, detection strategies, and mitigation recommendations.

CVSS Breakdown & Threat Level

• CVSS Score: 2.0 (Low)
• Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Physical (P) – Requires physical access to the device.
• Attack Complexity (AC): High (H) – Exploitation requires specialized hardware and knowledge.
• Privileges Required (PR): None (N) – No prior access needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited sensitive data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Low. The physical requirement and high complexity significantly reduce the risk in most environments.

Deep Dive & Mechanics

The vulnerability stems from insecure storage of sensitive information (e.g., credentials, configuration data) on the device’s firmware, accessible via the UART interface. UART is a common hardware debugging interface used for firmware development and diagnostics. On the Furbo devices, the UART pins are exposed on the circuit board, allowing an attacker to connect a serial adapter (e.g., USB-to-UART) and interact with the device’s bootloader or operating system.

Mechanics:

1. Physical Access: The attacker must open the device casing to access the UART pins.
2. Serial Connection: Using a UART adapter (e.g., FTDI cable), the attacker connects to the device’s serial console.
3. Boot Interruption: By sending break signals or manipulating boot parameters, the attacker can interrupt the normal boot process and gain a root shell or access to the filesystem.
4. Data Extraction: Once access is gained, sensitive data stored in plaintext or weakly encrypted files (e.g., /etc/config, /data/credentials) can be read.

Affected Firmware:

• Furbo 360: Up to FB0035_FW_036
• Furbo Mini: Up to MC0020_FW_074

Root Cause: Lack of secure storage mechanisms (e.g., encrypted filesystem, hardware-backed keystore) and failure to disable or protect the UART interface in production firmware.

Vulnerable vs. Patched Code

Since no patch is available, this section compares the vulnerable firmware behavior with expected secure practices.

Vulnerable (Furbo 360 FB0035_FW_036):

• UART interface enabled and accessible without authentication.
• Sensitive data stored in plaintext files (e.g., /etc/wpa_supplicant.conf with Wi-Fi passwords).
• No filesystem encryption or integrity checks.

Expected Patched Behavior:

• UART interface disabled or password-protected in production builds.
• Sensitive data stored using hardware-backed encryption (e.g., TPM or secure element).
• Filesystem encrypted with a device-specific key.

Example of vulnerable configuration (pseudo-code):

# /etc/inittab (vulnerable)
::respawn:/sbin/getty -L ttyS0 115200 vt100

Expected patched configuration:

# /etc/inittab (patched)
# UART disabled for production
# ::respawn:/sbin/getty -L ttyS0 115200 vt100

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Physical access to a Furbo 360 or Furbo Mini device.
• USB-to-UART adapter (e.g., FT232RL).
• Serial terminal software (e.g., PuTTY, screen, minicom).
• Screwdriver to open the device casing.

Steps:

1. Disassemble Device: Remove screws and open the casing to expose the main circuit board.
2. Identify UART Pins: Locate the UART header (typically 4 pins: VCC, GND, TX, RX). Use a multimeter to confirm.
3. Connect Adapter: Connect the UART adapter to the pins (GND to GND, TX to RX, RX to TX).
4. Open Serial Console: Configure terminal software for 115200 baud, 8 data bits, no parity, 1 stop bit.
5. Interrupt Boot: Power on the device and send a break signal (e.g., Ctrl+C or spacebar) during boot to enter the bootloader or shell.
6. Extract Data: Once in a shell, navigate to configuration directories and read sensitive files.

Example commands:

# After gaining shell access
cat /etc/wpa_supplicant.conf
cat /data/credentials.txt
ls -la /etc/config/

Blue Team (Defense & Detection)

Defensive Measures:

• Physical Security: Enclose devices in tamper-evident cases or secure enclosures.
• Firmware Hardening: Request vendor to provide a patched firmware that disables UART or adds authentication.
• Monitoring: Deploy network monitoring to detect anomalous traffic from the device (e.g., unexpected outbound connections).
• Inventory Management: Maintain an inventory of all Furbo devices and their firmware versions.

Detection:

• Physical Inspection: Regularly inspect devices for signs of tampering (e.g., opened casing, loose screws).
• Log Analysis: Monitor device logs for unexpected serial console activity (if available).
• Network Anomalies: Detect unusual data exfiltration patterns (e.g., large outbound transfers from the device).

Indicators of Compromise (IOCs)

Physical IOCs:

• Opened or damaged device casing.
• Presence of UART adapter or wires connected to the circuit board.
• Unusual solder marks or flux residue near UART pins.

Digital IOCs:

• Unauthorized access to configuration files (e.g., /etc/wpa_supplicant.conf).
• Presence of unknown SSH keys or backdoor accounts.
• Modified boot scripts or init files.

Network IOCs:

• Outbound connections to unknown IP addresses on non-standard ports.
• Increased data transfer from the device to external hosts.

Detection Engineering

YARA Rule

rule CVE_2025_11644_UART_SensitiveData
{
    meta:
        description = "Detects plaintext sensitive data in Furbo firmware images"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-11644"
    strings:
        $wifi = "wpa_supplicant.conf" ascii wide nocase
        $cred = "credentials" ascii wide nocase
        $pass = "password=" ascii wide nocase
        $uart = "ttyS0" ascii wide nocase
    condition:
        any of ($wifi, $cred, $pass) and $uart
}

Sigma Rule

title: Detection of Furbo UART Exploitation Attempt
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects physical access attempts to Furbo devices via UART interface
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: kernel
detection:
    selection:
        EventID: 1
        Image|endswith: '/getty'
        CommandLine|contains: 'ttyS0'
    condition: selection
falsepositives:
    - Legitimate firmware debugging by vendor
level: low
tags:
    - cve.2025.11644
    - attack.physical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11644 Furbo UART Data Exfiltration"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; byte_test:4,>,1000,0,relative; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Physical Security: Place Furbo devices in locked enclosures or areas with restricted access.
2. Firmware Update: Monitor Tomofun’s website for firmware updates. If none available, consider replacing the device.
3. Network Segmentation: Isolate Furbo devices on a separate VLAN with strict egress filtering.
4. Disable UART (if possible): For advanced users, physically disconnect or disable the UART interface by removing resistors or cutting traces (voids warranty).

Long-Term Recommendations:

• Vendor Engagement: Continue to pressure Tomofun for a security patch.
• Alternative Products: Evaluate pet cameras with better security practices (e.g., encrypted storage, secure boot).
• Regular Audits: Conduct periodic physical security assessments of IoT devices.

Workaround: If UART access is required for legitimate purposes, implement a physical lock or tamper switch that triggers an alert if the device is opened.

Valters IT