Skip to content

Commit a719335

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2g2c-ch77-q38g GHSA-464j-7q34-j9w2 GHSA-549v-4675-2339 GHSA-6cqp-frfr-84vg GHSA-9pr9-9ph6-wc7m
1 parent 16673c1 commit a719335

File tree

5 files changed

+262
-0
lines changed

5 files changed

+262
-0
lines changed

‎advisories/unreviewed/2025/10/GHSA-2g2c-ch77-q38g/GHSA-2g2c-ch77-q38g.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2g2c-ch77-q38g",
4+
"modified": "2025-10-13T00:30:13Z",
5+
"published": "2025-10-13T00:30:13Z",
6+
"aliases": [
7+
"CVE-2025-11649"
8+
],
9+
"details": "A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing manipulation results in use of hard-coded password. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11649"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.328060"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.328060"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.662769"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "HIGH",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-10-12T23:15:32Z"
49+
}
50+
}

‎advisories/unreviewed/2025/10/GHSA-464j-7q34-j9w2/GHSA-464j-7q34-j9w2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-464j-7q34-j9w2",
4+
"modified": "2025-10-13T00:30:13Z",
5+
"published": "2025-10-13T00:30:13Z",
6+
"aliases": [
7+
"CVE-2025-11651"
8+
],
9+
"details": "A vulnerability has been found in UTT 进取 518G up to V3v3.2.7-210919-161313. This vulnerability affects the function sub_4247AC of the file /goform/formRemoteControl. The manipulation of the argument Profile leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11651"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cymiao1978/cve/blob/main/13.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/cymiao1978/cve/blob/main/13.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.328068"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.328068"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.664925"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-10-13T00:15:33Z"
55+
}
56+
}

‎advisories/unreviewed/2025/10/GHSA-549v-4675-2339/GHSA-549v-4675-2339.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-549v-4675-2339",
4+
"modified": "2025-10-13T00:30:13Z",
5+
"published": "2025-10-13T00:30:13Z",
6+
"aliases": [
7+
"CVE-2025-11648"
8+
],
9+
"details": "A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11648"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.328059"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.328059"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.662768"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-918"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-12T22:15:33Z"
51+
}
52+
}

‎advisories/unreviewed/2025/10/GHSA-6cqp-frfr-84vg/GHSA-6cqp-frfr-84vg.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6cqp-frfr-84vg",
4+
"modified": "2025-10-13T00:30:13Z",
5+
"published": "2025-10-13T00:30:13Z",
6+
"aliases": [
7+
"CVE-2025-11650"
8+
],
9+
"details": "A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file /etc/shadow of the component Password Handler. Executing manipulation can lead to use of weak hash. The physical device can be targeted for the attack. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11650"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.328061"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.328061"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.662771"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-327"
46+
],
47+
"severity": "LOW",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-12T23:15:32Z"
51+
}
52+
}

‎advisories/unreviewed/2025/10/GHSA-9pr9-9ph6-wc7m/GHSA-9pr9-9ph6-wc7m.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9pr9-9ph6-wc7m",
4+
"modified": "2025-10-13T00:30:13Z",
5+
"published": "2025-10-13T00:30:13Z",
6+
"aliases": [
7+
"CVE-2025-11647"
8+
],
9+
"details": "A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the argument DeviceToken causes information disclosure. The attack is only possible within the local network. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The exploit has been published and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11647"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Information-Disclosure-DeviceToken.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.328058"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.328058"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.662767"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-200"
46+
],
47+
"severity": "LOW",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-12T22:15:32Z"
51+
}
52+
}

0 commit comments

Comments
 (0)