CVE-2025-11636: Furbo 360 Dog Camera SSRF Vulnerability

CVE-2025-11636 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Tomofun Furbo 360 Dog Camera firmware up to version FB0035_FW_036. This security flaw exists within the Account Handler component and allows remote attackers to manipulate server-side requests, potentially enabling access to internal network resources or services that should not be externally accessible.

The vulnerability requires high attack complexity, making exploitation difficult but not impossible for skilled attackers. The vendor (Tomofun) was contacted about this disclosure but did not respond, leaving affected devices without an official patch.

Critical Impact

Remote attackers can exploit the SSRF vulnerability in the Furbo 360 camera's Account Handler to forge server-side requests, potentially accessing internal network resources and compromising the security of connected IoT environments.

Affected Products

• Furbo 360 Dog Camera Firmware (up to version FB0035_FW_036)
• Furbo 360 Dog Camera Hardware
• Tomofun Furbo 360 IoT devices running vulnerable firmware

Discovery Timeline

• October 12, 2025 - CVE-2025-11636 published to NVD
• October 30, 2025 - Last updated in NVD database

Technical Details for CVE-2025-11636

Vulnerability Analysis

CVE-2025-11636 is classified under CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches remote resources based on user-supplied input without proper validation. In the context of the Furbo 360 Dog Camera, the Account Handler component fails to adequately validate or sanitize incoming requests, allowing attackers to craft malicious requests that the server processes on their behalf.

SSRF vulnerabilities in IoT devices like smart cameras are particularly concerning because these devices often have privileged access to internal network segments and may communicate with cloud services or other connected home devices. An attacker exploiting this vulnerability could potentially:

• Access internal services not intended for external exposure
• Scan internal network resources and enumerate connected devices
• Bypass network security controls by pivoting through the compromised camera
• Exfiltrate sensitive information from internal systems

The high attack complexity noted in this vulnerability indicates that successful exploitation requires specific conditions or sophisticated techniques, which somewhat limits the immediate risk to casual attackers.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the Account Handler component of the Furbo 360 firmware. The component processes user-controlled data that specifies resource locations without properly verifying that the requested resources are legitimate external endpoints. This allows attackers to redirect server-side requests to arbitrary internal or external addresses.

Attack Vector

The attack vector is network-based, meaning exploitation can be performed remotely without physical access to the device. An attacker would need to craft specially formatted requests to the Account Handler component that manipulate the destination of server-side requests.

The vulnerability requires no user interaction and no prior authentication, though the high complexity rating suggests that attackers must overcome certain technical hurdles to achieve successful exploitation. These hurdles may include timing constraints, specific network configurations, or the need to chain multiple techniques together.

Due to the absence of verified code examples, detailed technical exploitation mechanisms should be referenced from the VulDB advisory for this vulnerability.

Detection Methods for CVE-2025-11636

Indicators of Compromise

• Unusual outbound network connections from Furbo 360 cameras to internal IP addresses or unexpected external hosts
• Anomalous traffic patterns in the Account Handler service logs showing requests to internal resources
• DNS queries from the camera device for internal hostnames or private IP ranges
• Unexpected HTTP/HTTPS requests originating from the camera to cloud metadata endpoints or internal services

Detection Strategies

• Deploy network monitoring to track all traffic from IoT devices, flagging requests to internal network ranges or suspicious external endpoints
• Implement DNS logging and analyze queries from the Furbo camera for requests to internal or reserved IP ranges
• Configure firewall rules to alert on any outbound connections from the camera that deviate from expected communication patterns with Furbo cloud services
• Use intrusion detection systems (IDS) with signatures for common SSRF exploitation patterns

Monitoring Recommendations

• Isolate IoT devices like the Furbo 360 on a dedicated network segment (VLAN) with strict egress filtering
• Monitor for firmware update attempts and verify they come from legitimate Tomofun sources
• Enable logging on network boundary devices to capture all traffic from the affected camera
• Regularly audit network traffic from IoT devices for anomalous behavior patterns

How to Mitigate CVE-2025-11636

Immediate Actions Required

• Isolate affected Furbo 360 cameras on a separate network segment with restricted access to internal resources
• Implement strict firewall rules limiting the camera's outbound connections to only known Furbo/Tomofun service endpoints
• Consider temporarily disabling network access for vulnerable devices until a patch is available
• Monitor for any vendor communication regarding security updates, as the vendor has not responded to disclosure attempts

Patch Information

No official patch is currently available from Tomofun. The vendor was contacted regarding this vulnerability but did not respond. Users should monitor the official Furbo support channels for any future firmware updates that may address this security issue.

For technical details and ongoing tracking of this vulnerability, refer to the VulDB entry #328047.

Workarounds

• Place the Furbo 360 camera behind a firewall with strict egress filtering that only permits connections to verified Furbo cloud service IP addresses
• Implement network segmentation to isolate IoT devices from sensitive internal resources
• Use a dedicated IoT VLAN that has no routing access to internal network segments or sensitive services
• Consider using a reverse proxy or application-layer firewall to filter and inspect traffic to and from the camera device

# Example network isolation configuration (iptables)
# Block the Furbo camera from accessing internal network ranges
iptables -A FORWARD -s <FURBO_CAMERA_IP> -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -s <FURBO_CAMERA_IP> -d 172.16.0.0/12 -j DROP
iptables -A FORWARD -s <FURBO_CAMERA_IP> -d 192.168.0.0/16 -j DROP

# Allow only connections to known Furbo cloud services
iptables -A FORWARD -s <FURBO_CAMERA_IP> -d <FURBO_CLOUD_IP_RANGE> -j ACCEPT
iptables -A FORWARD -s <FURBO_CAMERA_IP> -j DROP