by Kastro
Paper/Archive/CVE-2025-3654

CVE-2025-3654

Petlibrio Smart Pet Feeder Platform — Petlibro Smart Pet Feeder Platform through 1.7.31 Information Disclosure via API endpoint

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 20.7.207 × 204.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware information by exploiting insecure API endpoints. Attackers can retrieve device serial numbers and MAC addresses through /device/devicePetRelation/getBoundDevices using pet IDs, enabling full device control without proper authorization checks.

Affected

ProductAffectedFixed inSource
Smart Pet Feeder Platform≤ 1.7.31–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupbobdahacker.com/blog/petlibrowriteupvulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-information-disclosure-via-api-endpoint