PT-2026-1181 · Petlibro · Petlibro Smart Pet Feeder Platform

Bobdahacker · Published 2026-01-03 · Updated 2026-02-03 · CVE-2025-3653

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description The Petlibro Smart Pet Feeder Platform is affected by an improper access control issue. The platform allows unauthorized device manipulation by accepting arbitrary serial numbers without verifying ownership. An attacker can control any device by sending serial numbers to device control APIs. This allows them to change feeding schedules, trigger manual feeds, access camera feeds, and modify device settings without authorization checks. The vulnerable API endpoints are used for device control. The vulnerable parameter is the serial number.

Recommendations Versions prior to 1.7.31 should be updated.

Fix

Weakness Enumeration

CWE-612

Related Identifiers

CVE-2025-3653

Affected Products

Petlibro Smart Pet Feeder Platform

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-3653 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3653 · Vendor Advisory
• https://t.me/CVEtracker/41322 · Telegram Post
• https://twitter.com/RedPacketSec/status/2007614545930392020 · Twitter Post
• https://bobdahacker.com/blog/petlibro · Note
• https://t.me/cveNotify/147647 · Telegram Post
• https://twitter.com/cracbot/status/2009218569662550022 · Twitter Post
• https://vulncheck.com/advisories/petlibro-smart-pet-feeder-through-platform-improper-access-control-via-api-endpoint · Note
• https://t.me/cveNotify/150772 · Telegram Post
• https://twitter.com/CVEnew/status/2007600722473365696 · Twitter Post