CVE-2025-11643 | Tomofun Furbo 360/Furbo Mini MQTT Client Certificate /squashfs-root/furbo_img hard-coded credentials

October 11, 2025 Yanac

A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/furbo_img of the component MQTT Client Certificate. Performing manipulation results in hard-coded credentials.

This vulnerability was named CVE-2025-11643. The attack may be initiated remotely. There is no available exploit.

The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More