CVE-2025-3646 | THREATINT

Description

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authorization bypass vulnerability that allows unauthorized users to add users as shared owners to any device by exploiting missing permission checks. Attackers can send requests to the device share API to gain unauthorized access to devices and view owner information without proper authorization validation.

PUBLISHED Reserved 2025-04-15 | Published 2026-01-03 | Updated 2026-01-05 | Assigner VulnCheck

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

HIGH: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Problem types

Missing Authentication for Critical Function

Product status

Default status

unaffected

Unknown (semver)

affected

Credits

bobdahacker finder

References

bobdahacker.com/blog/petlibro (Security Research: Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who Asks) third-party-advisory technical-description

www.vulncheck.com/...thorization-bypass-via-device-share-api (VulnCheck Advisory: Petlibro Smart Pet Feeder Platform through 1.7.31 Authorization Bypass via Device Share API) third-party-advisory

cve.org (CVE-2025-3646)

nvd.nist.gov (CVE-2025-3646)

Download JSON