The connection can be made through a laptop, opening up more opportunities to control the toy. "Our security experts were able to upload and play a custom audio file on the Furby", the report said.
Ahead of 2017's present buying season, United Kingdom consumer rights group Which? has warned parents about the risks of giving connected toys to their children, and called for devices with known security and/or privacy risks to be banned from sale on kids safety grounds.
When switched on, the Furby Connect - on sale at Argos, Amazon, Smyths and Toys R Us - could be connected with any device within a Bluetooth range of 10 to 30 metres.
However, since the range of Bluetooth is typically limited to about 32 feet, the main concern would be individuals with malicious intent in the child's immediate vicinity.
"Connected toys are becoming increasingly popular, but as our investigation shows, anyone considering buying one should apply a level of caution", said Alex Neill, managing director of home products and services.
This summer the Federal Bureau of Investigation also issued a consumer notice warning that IoT toys "could put the privacy and safety of children at risk due to the large amount of personal information that may be unwittingly disclosed".
In the case of the Furby, Which?'s external security researchers also thought it would be possible for someone to re-engineer its firmware to turn the toy into a listening device due to a vulnerability they found in the toy's design (which it's not publicly disclosing).
Rose McGowan granted waiver to skip arraignment; preliminary trial set for January
She realized after the flight, as she headed to the Women's March, that her wallet was gone and said she does not use cocaine. The 44-year-old handed herself into police in nearby Loudoun County, Virginia, on Tuesday after an arrest warrant was issued.
This could mean using pins or passcodes when pairing devices and encryption for any data that is transmitted. Researchers discovered the toys use unsecured Bluetooth connections that could be "too easy" for someone to use them to talk to a child. "If that can't be guaranteed, then the products should not be sold".
"With the i-Que Intelligent Robot, available from Argos and Hamleys, the investigation discovered that anyone could download the app, find an i-Que within their Bluetooth range and start using the robot's voice by typing into a text field".
"A tremendous amount of engineering would be required to reverse-engineer the product as well as to create new firmware", it said.
The company said it was "confident" in the design of its toys and its ability to deliver a "secure play experience".
Hasbro, which makes the Furby Connect, said: "Children's privacy is a top priority, and that is why we carefully designed the Furby Connect and the Furby Connect World app to comply with children's privacy laws".
Hasbro, maker of Furby Connect, one of the toys identified in the Which? report, says the company takes children's security very seriously, but that it is highly unlikely that their toy would actually be manipulated.