Vulnerability · Published Oct 12, 2025 · Assigned by VulDB

CVE-2025-11635Tomofun Furbo 360 File Upload resource consumption

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in Furbo 360 from Tomofun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036. This vulnerability affects unknown code of the component File Upload. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Tomofun	Furbo 360	FB0035_FW_036

Weakness: CWE-400, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X

References

VDB-328046 | Tomofun Furbo 360 File Upload resource consumption vdb-entry, technical-description
VDB-328046 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
Submit #661354 | Tomofun Furbo 360 ≤ FB0035_FW_036 Uncontrolled Resource Consumption third-party-advisory