PT-2026-1180 · Petlibro · Petlibro Smart Pet Feeder Platform

Bobdahacker · Published 2026-01-03 · Updated 2026-02-03 · CVE-2025-3652

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description The Petlibro Smart Pet Feeder Platform is affected by an information disclosure issue. This allows unauthorized access to private audio recordings. The issue stems from exploiting sequential audio IDs and insecure assignment endpoints. Attackers can send requests to the /device/deviceAudio/use API endpoint with arbitrary audio IDs to assign recordings to any device. Subsequently, attackers can retrieve audio URLs to access recordings belonging to other users. The vulnerable parameter is the audio ID used in the request to the /device/deviceAudio/use endpoint.

Recommendations Update to a version later than 1.7.31.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-3652

Affected Products

Petlibro Smart Pet Feeder Platform

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3652 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3652 · Vendor Advisory
• https://twitter.com/CVEnew/status/2007600723345744200 · Twitter Post
• https://t.me/cveNotify/147646 · Telegram Post
• https://vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-audio-information-disclosure-via-api-endpoint · Note
• https://t.me/CVEtracker/41321 · Telegram Post
• https://bobdahacker.com/blog/petlibro · Note
• https://t.me/cveNotify/150771 · Telegram Post