CVE-2025-11650

Executive Summary

CVE-2025-11650 identifies a critical security flaw in Tomofun Furbo 360 and Furbo Mini pet cameras. The vulnerability resides in the /etc/shadow file, where the password handler uses a weak hashing algorithm. This allows an attacker with physical access to the device to extract and crack password hashes with relative ease. The attack complexity is high due to the requirement of physical proximity, but the exploit has been publicly disclosed, increasing the risk for unpatched devices. The vendor has not responded to disclosure attempts, leaving users with no official patch.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an IoT device.

CVSS Breakdown & Threat Level

• CVSS Score: 1.8 (Low)
• Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Physical (P) – Requires physical access to the device.
• Attack Complexity (AC): High (H) – Exploitation requires specialized knowledge and equipment.
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L) – Only password hashes are exposed.
• Integrity (I): None (N)
• Availability (A): None (N)

Threat Level: Low. The physical access requirement significantly limits the attack surface. However, the public disclosure of the exploit means that any attacker with physical access can easily compromise the device.

Deep Dive & Mechanics

The vulnerability is a classic case of weak password hashing. The /etc/shadow file on Linux-based systems stores user password hashes. In a secure implementation, these hashes should be generated using a strong, salted algorithm like SHA-512 (crypt) or bcrypt. The Furbo firmware uses a weak hash (likely MD5 or DES-based crypt), which is susceptible to brute-force and dictionary attacks.

Attack Flow:

1. Physical Access: The attacker gains physical access to the Furbo device (e.g., by stealing it or accessing it in an unattended location).
2. Extraction: The attacker connects to the device's UART or JTAG interface, or removes the storage (e.g., eMMC or NAND flash) to extract the filesystem.
3. Read /etc/shadow: The attacker reads the /etc/shadow file, which contains the password hash for the root or admin user.
4. Crack Hash: Using tools like hashcat or John the Ripper, the attacker cracks the weak hash to recover the plaintext password.
5. Privileged Access: With the password, the attacker gains root access to the device, allowing them to modify firmware, install malware, or pivot to other network devices.

Vulnerable vs. Patched Code

Vulnerable Code (Furbo 360 FB0035_FW_036):

# /etc/shadow entry (example)
root:$1$salt$hash:18265:0:99999:7:::

The $1$ prefix indicates MD5-based crypt, which is weak.

Patched Code (Hypothetical):

# /etc/shadow entry (example)
root:$6$salt$hash:18265:0:99999:7:::

The $6$ prefix indicates SHA-512 crypt, which is strong.

Explanation: The vulnerable firmware uses MD5 ($1$), which can be cracked at billions of hashes per second. A patched version would use SHA-512 ($6$) or bcrypt, making cracking computationally infeasible.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Physical access to a Furbo 360 or Furbo Mini device.
• A USB-to-UART adapter (e.g., FTDI) or ability to desolder eMMC/NAND.
• Linux host with hashcat or John the Ripper.

Steps:

1. Connect to UART:

   # Identify UART pins on the PCB (usually 3.3V, GND, TX, RX)
   # Connect using screen or minicom
   screen /dev/ttyUSB0 115200
   

2. Boot into recovery shell: Interrupt boot process (e.g., press a key during U-Boot) to get a shell.
3. Extract /etc/shadow:

   cat /etc/shadow
   

   Or mount the filesystem:

   mount /dev/mmcblk0p1 /mnt
   cat /mnt/etc/shadow
   

4. Crack the hash:

   # Save hash to file
   echo 'root:$1$salt$hash:18265:0:99999:7:::' > hash.txt
   # Crack with hashcat (mode 500 = MD5 crypt)
   hashcat -m 500 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
   

Blue Team (Defense & Detection)

Detection:

• Monitor for physical tampering (e.g., case opening, UART connection).
• Implement tamper-evident seals.
• Use network monitoring to detect anomalous traffic from the device (e.g., outbound connections to unknown IPs).

Mitigation:

• Replace the device with a patched version if available.
• If patching is not possible, isolate the device on a separate VLAN with strict firewall rules.
• Disable physical debug interfaces (e.g., UART) in firmware if possible.

Indicators of Compromise (IOCs)

• File: /etc/shadow with MD5 ($1$) or DES ($2$) hashes.
• Firmware Version: Furbo 360 <= FB0035_FW_036, Furbo Mini <= MC0020_FW_074.
• Physical Evidence: Signs of tampering (e.g., opened case, soldered wires on UART pads).
• Network: Unusual SSH or telnet sessions from the device (if password is cracked and remote access is enabled).

Detection Engineering

YARA Rule

rule CVE_2025_11650_Weak_Shadow_Hash {
    meta:
        description = "Detects weak MD5 password hashes in /etc/shadow files from Tomofun Furbo devices"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-11650"
    strings:
        $md5_hash = /\$1\$[A-Za-z0-9\/\.]{8}\$[A-Za-z0-9\/\.]{22}/ 
        $shadow_header = "root:"
    condition:
        $shadow_header and $md5_hash
}

Sigma Rule

title: CVE-2025-11650 - Weak Password Hash in Furbo Device
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects extraction of weak MD5 password hashes from /etc/shadow on Tomofun Furbo devices
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/cat'
        CommandLine|contains: '/etc/shadow'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11650 - Furbo Device Shadow File Exfiltration"; flow:to_server,established; content:"/etc/shadow"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Physical Security: Restrict physical access to Furbo devices. Place them in secure, monitored locations.
2. Network Segmentation: Isolate Furbo devices on a separate VLAN with no direct internet access unless necessary.
3. Firmware Update: Check Tomofun's website for any future firmware updates. If none are available, consider replacing the device.

Long-Term Fix:

• The vendor must release a firmware update that replaces the weak hash algorithm with a strong one (e.g., SHA-512 or bcrypt).
• Users should demand a patch from Tomofun or switch to a more secure alternative.

Workaround:

• If the device is critical and cannot be replaced, consider flashing a custom firmware (if available) that fixes the hash algorithm.

Valters IT