Tomofun vulnerabilities
We track 4 vulnerabilities in Tomofun products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2025.
Latest Tomofun vulnerabilities
- 7.4 High severity
Furbo 360: Server-Side Request Forgery
A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from r
- 8.1 High severity
Furbo 360: Incorrect Privilege Assignment
A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation results in improper access controls. The attack can only be performed from the local network. The exploit
- 8.1 High severity
Furbo 360: Use of Hard-coded Password
A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/furbo_img of the component MQTT Client Certificate. Performing manipulation results in hard-coded cre
- 8.1 High severity
Furbo 360: Server-Side Request Forgery
A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handler. Such manipulation leads to server-side request forgery. The attack can be executed remotely. This