CVE-2025-3653 - CVE House

Back to Database

Status published Medium CVE-2025-3653

Petlibro Smart Pet Feeder through 1.7.31 Platform Improper Access Control via API endpoint

6.9 CVSS

Vulnerability Description

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access control vulnerability that allows unauthorized device manipulation by accepting arbitrary serial numbers without ownership verification. Attackers can control any device by sending serial numbers to device control APIs to change feeding schedules, trigger manual feeds, access camera feeds, and modify device settings without authorization checks.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3653

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

bobdahacker

References

More from Petlibrio

View All →

Petlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint

Petlibro Smart Pet Feeder Platform through 1.7.31 Information Disclosure via API endpoint

Petlibro Smart Pet Feeder Platform through 1.7.31 Audio Information Disclosure via API endpoint

Petlibro Smart Pet Feeder Platform through 1.7.31 Authorization Bypass via Device Share API

Petlibro Smart Pet Feeder Platform through 1.7.31 Authentication Bypass via API endpoint

Affected Vendor

Petlibrio

View all reports →

Affected Software

Smart Pet Feeder Platform

Vulnerable Versions:

Unknown

Timeline

Official Publish: January 3rd, 2026

Last Modified: January 5th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.