CVE-2025-3654CRITICAL 9.8EPSS p14.9%

CVE-2025-3654CVE-2025-3654

Description

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware information by exploiting insecure API endpoints. Attackers can retrieve device serial numbers and MAC addresses through /device/devicePetRelation/getBoundDevices using pet IDs, enabling full device control without proper authorization checks.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.24% probability of exploitation · percentile 14.9% · 2026-06-18T12:00:27Z
Published2026-01-04
Last modified2026-02-03

Underlying weaknesses· 1

CWE-612

References

  1. https://bobdahacker.com/blog/petlibro
  2. https://www.vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-information-disclosure-via-api-endpoint

1

TypeTargetConfidenceTier
WeaknessImproper Authorization of Index Containing Sensitive Informationcwe-6120%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-3653
CVE
CVE-2025-3646
CVE
CVE-2025-3660
CVE
CVE-2025-15115
CVE
CVE-2025-11646
CVE
CVE-2025-41648
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.