Paper/Archive/CVE-2025-3653

CVE-2025-3653

Petlibrio Smart Pet Feeder Platform — Petlibro Smart Pet Feeder through 1.7.31 Platform Improper Access Control via API endpoint

EPSS 0.3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 16.8.168 × 203.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access control vulnerability that allows unauthorized device manipulation by accepting arbitrary serial numbers without ownership verification. Attackers can control any device by sending serial numbers to device control APIs to change feeding schedules, trigger manual feeds, access camera feeds, and modify device settings without authorization checks.

Affected

ProductAffectedFixed inSource

Smart Pet Feeder Platform≤ 1.7.31–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulnCheck (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulnCheck (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupbobdahacker.com/blog/petlibro writeupvulncheck.com/advisories/petlibro-smart-pet-feeder-through-platform-improper-access-control-via-api-endpoint