PT-2026-1179 · Petlibro · Petlibro Smart Pet Feeder Platform

Bobdahacker · Published 2026-01-03 · Updated 2026-02-03 · CVE-2025-3646

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description The Petlibro Smart Pet Feeder Platform is affected by an authorization bypass. This allows unauthorized users to add themselves as shared owners to any device. The issue is due to missing permission checks when processing requests to the device share API. An attacker can exploit this to gain unauthorized access to devices and view owner information without proper authorization.

Recommendations Update to a version later than 1.7.31.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-3646

Affected Products

Petlibro Smart Pet Feeder Platform

References · 10

• https://osv.dev/vulnerability/CVE-2025-3646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3646 · Security Note
• https://t.me/CVEtracker/41320 · Telegram Post
• https://twitter.com/RedPacketSec/status/2007614544642748737 · Twitter Post
• https://bobdahacker.com/blog/petlibro · Note
• https://t.me/cveNotify/150770 · Telegram Post
• https://t.me/cveNotify/147645 · Telegram Post
• https://vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-authorization-bypass-via-device-share-api · Note
• https://twitter.com/CVEnew/status/2007600724255850498 · Twitter Post
• https://twitter.com/cracbot/status/2009218567926108446 · Twitter Post