PT-2026-1180 · Petlibro · Petlibro Smart Pet Feeder Platform

Bobdahacker · Publicado 2026-01-03 · Atualizado 2026-02-03 · CVE-2025-3652

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description The Petlibro Smart Pet Feeder Platform is affected by an information disclosure issue. This allows unauthorized access to private audio recordings. The issue stems from exploiting sequential audio IDs and insecure assignment endpoints. Attackers can send requests to the /device/deviceAudio/use API endpoint with arbitrary audio IDs to assign recordings to any device. Subsequently, attackers can retrieve audio URLs to access recordings belonging to other users. The vulnerable parameter is the audio ID used in the request to the /device/deviceAudio/use endpoint.

Recommendations Update to a version later than 1.7.31.

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2025-3652

Produtos afetados

Petlibro Smart Pet Feeder Platform

Referências · 8

• https://twitter.com/CVEnew/status/2007600723345744200 · Publicação no Twitter
• https://t.me/cveNotify/147646 · Publicação no Telegram
• https://vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-audio-information-disclosure-via-api-endpoint · Nota
• https://t.me/CVEtracker/41321 · Publicação no Telegram
• https://bobdahacker.com/blog/petlibro · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-3652 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-3652 · Aviso do Fabricante
• https://t.me/cveNotify/150771 · Publicação no Telegram