Furbo 360 Dog Camera

Furbo 360 Dog Camera
Security Grade C Calculator v1	Furbo 360 Dog Camera Brand: Furbo (Parent: Tomofun) Category: Pet camera • Model / Gen: Furbo 360 (3rd-generation hardware family) Furbo 360 Dog Camera Release Date: 2021 • Status: In sale Classification Date: 2026-10-22 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Very common	[1] 🔗 Proof	Researchers obtained UART and a root shell and modified firmware. Hardware access gives full control.
Known vulnerabilities	Very common	[2] 🔗 Proof	CVE-2020-24918 is an unauthenticated RTSP buffer overflow allowing remote takeover. CVE-2025-11635 is a remote resource-consumption flaw in Furbo 360.
Prior attacks	Rare	🔗 Proof	Multiple public research efforts exist, but no documented botnet or mass exploitation.
Updatability	Very common	🔗 Proof	Tomofun significantly improved security after 2021 and ships OTA firmware updates. Researchers note the newer device is much harder to attack.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Cloud account and RTSP digest authentication exist, but RTSP was initially accessible without auth and BLE pairing is used for onboarding.
Communications	Encrypted with obselete encryption	🔗 Proof	TLS is used, but researchers demonstrated TLS downgrade and update-channel weaknesses on older firmware.
Storage	Encrypted with obselete encryption	🔗 Proof	Firmware and credentials were recoverable from the device, so storage protection is partial.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Single Furbo account per device, with no role hierarchy documented.
Authentication	Basic	🔗 Proof	Email and password account plus device pairing. Mandatory 2FA is not documented.
Brute-force protection	Basic	🔗 Proof	Standard account recovery, but no published device-level lockout.
Event logging	Partial logging	🔗 Proof	The app records motion and barking events and video history, but no administrator-access audit log.
Passwords	Require change after setup	🔗 Proof	No factory default account password; the user sets it at signup.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Proprietary embedded Linux (Ambarella SoC) (Companion App: Furbo app)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera: 1080p, 360-degree rotating
Sound & Connectivity	Sound: Two-way audio • Connectivity: Wi-Fi 2.4 GHz, Bluetooth LE 4.2
Physical (Dimensions & Mass)	Dimensions: • Mass: