CVE-2025-11647 is a vulnerability identified in the Tomofun Furbo 360 and Furbo Mini pet cameras, specifically related to the Bluetooth Low Energy (BLE) GATT Service component. The vulnerability arises from improper handling of the DeviceToken argument during GATT operations, which can be manipulated by an attacker to cause information disclosure. This flaw allows an attacker within the same local network to extract sensitive data from the device without requiring authentication or user interaction. The attack complexity is high, indicating that exploitation requires specialized knowledge and effort, and the exploitability is considered difficult. The affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Despite the publication of an exploit, the vendor Tomofun has not responded or provided patches to remediate the issue. The vulnerability has a CVSS 4.0 base score of 2.3, reflecting its low severity due to limited impact on confidentiality and no impact on integrity or availability. The attack vector is adjacent network (local network), and the vulnerability does not require privileges or user interaction, but the high attack complexity and limited scope reduce its overall risk. This vulnerability primarily threatens the confidentiality of information processed or stored by the affected devices, potentially exposing sensitive user data or device tokens that could be leveraged for further attacks or privacy violations.

For European organizations, the primary impact of CVE-2025-11647 is the potential leakage of sensitive information from Furbo 360 and Furbo Mini devices deployed within local networks. Although the vulnerability does not allow remote exploitation over the internet, internal attackers or compromised devices within the same network could exploit this flaw to gain unauthorized access to device tokens or other sensitive data. This could lead to privacy breaches, especially in environments where these cameras are used for monitoring pets or homes, potentially exposing user behavior or presence information. In office or corporate settings where such devices might be connected to internal networks, the vulnerability could be leveraged as a foothold for lateral movement or reconnaissance. Given the vendor's lack of response and absence of patches, organizations must rely on network-level mitigations. The low CVSS score indicates limited direct impact on system integrity or availability, but the confidentiality breach risk remains relevant under strict European data protection regulations such as GDPR. Failure to mitigate could result in compliance issues and reputational damage if sensitive user data is exposed.

1. Network Segmentation: Isolate Furbo devices on a separate VLAN or network segment with restricted access to minimize exposure to internal threats. 2. Disable Bluetooth if not required: Since the vulnerability involves the BLE GATT Service, disabling Bluetooth functionality on the devices or network where possible reduces attack surface. 3. Monitor Local Network Traffic: Deploy network monitoring tools to detect unusual BLE or local network activity targeting these devices. 4. Access Control: Limit physical and network access to trusted users and devices only, preventing unauthorized devices from joining the local network. 5. Firmware Management: Regularly check for vendor updates or advisories; although no patch is currently available, future updates may address the issue. 6. User Awareness: Inform users about the risk and encourage minimizing sensitive data exposure via these devices. 7. Incident Response Preparedness: Develop procedures to quickly isolate affected devices if suspicious activity is detected. 8. Consider Device Replacement: For high-security environments, evaluate replacing vulnerable devices with alternatives that have active vendor support and security updates.