PT-2026-1181 · Petlibro · Petlibro Smart Pet Feeder Platform

Bobdahacker · Publicado 2026-01-03 · Atualizado 2026-02-03 · CVE-2025-3653

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description The Petlibro Smart Pet Feeder Platform is affected by an improper access control issue. The platform allows unauthorized device manipulation by accepting arbitrary serial numbers without verifying ownership. An attacker can control any device by sending serial numbers to device control APIs. This allows them to change feeding schedules, trigger manual feeds, access camera feeds, and modify device settings without authorization checks. The vulnerable API endpoints are used for device control. The vulnerable parameter is the serial number.

Recommendations Versions prior to 1.7.31 should be updated.

Correção

Enumeração de Fraquezas

CWE-612

Identificadores relacionados

CVE-2025-3653

Produtos afetados

Petlibro Smart Pet Feeder Platform

Referências · 10

• https://t.me/CVEtracker/41322 · Publicação no Telegram
• https://twitter.com/RedPacketSec/status/2007614545930392020 · Publicação no Twitter
• https://bobdahacker.com/blog/petlibro · Nota
• https://t.me/cveNotify/147647 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-3653 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-3653 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2009218569662550022 · Publicação no Twitter
• https://vulncheck.com/advisories/petlibro-smart-pet-feeder-through-platform-improper-access-control-via-api-endpoint · Nota
• https://t.me/cveNotify/150772 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2007600722473365696 · Publicação no Twitter