CVE-2025-3652
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows unauthorized access to private audio recordings by exploiting sequential audio IDs and insecure assignment endpoints. Attackers can send requests to /device/deviceAudio/use with arbitrary audio IDs to assign recordings to any device, then retrieve audio URLs to access other users' private recordings.
Risk Assessment
The risk involves potential privacy breaches through disclosure of sensitive audio recordings, which could lead to espionage or theft of personal data.
Recommendation
Immediately update Petlibro Smart Pet Feeder Platform to the latest version that fixes this vulnerability, and implement authorization mechanisms and random audio IDs.
Other vulnerabilities in Petlibro Smart Pet Feeder Platform
See all- CVE-2025-3660Medium
A broken access control vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs to retrieve sensitive information.
- CVE-2025-3654Medium
A vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows unauthorized access to device hardware information through insecure API endpoints. Attackers can exploit pet IDs to retrieve serial numbers and MAC addresses, leading to full device control.
- CVE-2025-3653High
A vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows unauthorized device manipulation by accepting arbitrary serial numbers without ownership verification. Attackers can control any device by sending serial numbers to device control APIs.
- CVE-2025-3646High
An authorization bypass vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows unauthorized users to add themselves as shared owners to any device by exploiting missing permission checks in the device share API.
- CVE-2025-15115Medium
The vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows authentication bypass by exploiting OAuth token validation flaws in the social login system. An unauthenticated attacker can send a request to /member/auth/thirdLogin with arbitrary Google IDs and phoneBrand parameters to obtain full session tokens and account access without proper OAuth verification.
Original NVD description (English source)
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to private audio recordings by exploiting sequential audio IDs and insecure assignment endpoints. Attackers can send requests to /device/deviceAudio/use with arbitrary audio IDs to assign recordings to any device, then retrieve audio URLs to access other users' private recordings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS