CVE-2025-3654
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows unauthorized access to device hardware information through insecure API endpoints. Attackers can exploit pet IDs to retrieve serial numbers and MAC addresses, leading to full device control.
Risk Assessment
The risk involves potential takeover of the pet feeder by an unauthorized attacker, which could result in privacy breaches and device malfunction.
Recommendation
It is recommended to immediately update the Petlibro Smart Pet Feeder Platform to the latest version and implement authorization mechanisms for all API endpoints.
Original NVD description (English source)
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware information by exploiting insecure API endpoints. Attackers can retrieve device serial numbers and MAC addresses through /device/devicePetRelation/getBoundDevices using pet IDs, enabling full device control without proper authorization checks.