Cyber Resilience

CVE-2025-11649

Exposed Creds in Furbo Mini Firmware ≤ 074

Exposed Creds
Published
12 October 2025
Modified
29 April 2026
CVSS Score v4 6.4
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0013 3th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-11649 is a medium-severity Use of Hard-coded Password (CWE-259) vulnerability in Furbo Furbo Mini Firmware. Its CVSS base score is 6.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing manipulation results in use of hard-coded password. The attack must be initiated from a local…

more

position. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)
CWE-255CWE-259

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Hard-coded password for the local root account enables use of default accounts (T1078.001) to gain privileged access.

CVEs Like This One

CVE-2025-11643Same product: Furbo Furbo 360 Dog Camera
CVE-2025-11650Same product: Furbo Furbo 360 Dog Camera
CVE-2025-11638Same product: Furbo Furbo 360 Dog Camera
CVE-2025-11644Same product: Furbo Furbo 360 Dog Camera
CVE-2025-11646Same product: Furbo Furbo 360 Dog Camera
CVE-2025-11642Same product: Furbo Furbo 360 Dog Camera
CVE-2025-11640Same product: Furbo Furbo 360 Dog Camera
CVE-2025-11633Same product: Furbo Furbo 360 Dog Camera
CVE-2025-11641Same product: Furbo Furbo 360 Dog Camera
CVE-2025-11647Same product: Furbo Furbo 360 Dog Camera

Affected Assets

furbo
furbo mini firmware
≤ 074
furbo
furbo 360 dog camera firmware
≤ 036

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • IA-5 Authenticator Management
  • AC-6 Least Privilege
  • CM-6 Configuration Settings
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management good match
prevent

Directly prohibits embedding or using hard-coded passwords for the root account by requiring secure authenticator generation, storage, and rotation.

AC-6 Least Privilege partial match
prevent

Enforces least privilege so that even if the hard-coded root password is known, the account cannot perform unrestricted actions on the device.

CM-6 Configuration Settings partial match
prevent

Mandates applying secure configuration settings that remove or replace hard-coded credentials in firmware before deployment.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prohibit embedding credentials in source code or binaries.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.17 Authentication information none match
none

Requiring users to change temporary or default passwords at first use stops the continued existence of hard-coded or guessable passwords that are shipped with the product.

References