Furbo 360 / Furbo Mini vulnerabilities

A weakness was identified in Tomofun Furbo 360 and Furbo Mini in the UART Interface leading to insecure storage of sensitive information. The attack requires physical access and is highly complex; affected firmware includes Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.

Hard-coded credentials were discovered in Tomofun Furbo 360 and Furbo Mini in /squashfs-root/furbo_img within the MQTT Client Certificate component. The attack may be initiated remotely but is highly complex; affected firmware includes Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.

A flaw was found in Tomofun Furbo 360 and Furbo Mini in the Bluetooth Handler component. Manipulation of an unknown function can lead to denial of service. The attacker must be present on the local network; affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074.