CVE-2025-3654 Petlibrio CVE debrief

Who should care

Users of Petlibro Smart Pet Feeder Platform versions up to 1.7.31 should be aware of this vulnerability and take steps to mitigate it. Affected operators and platforms should review the vulnerability details and assess their exposure. Vulnerability management and security teams should prioritize the deployment of patches or mitigations to prevent exploitation. Security teams should also monitor for suspicious activity related to device serial numbers and MAC addresses.

Technical summary

CVE-2025-3654 is a medium-severity information disclosure vulnerability in Petlibro Smart Pet Feeder Platform versions up to 1.7.31. The vulnerability allows unauthorized access to device hardware information by exploiting insecure API endpoints. Attackers can retrieve device serial numbers and MAC addresses through /device/devicePetRelation/getBoundDevices using pet IDs, enabling full device control without proper authorization checks. This vulnerability has a CVSS score of 6.9 and is classified as MEDIUM.

Defensive priority

Medium

Recommended defensive actions

• Inventory and verify Petlibro Smart Pet Feeder Platform versions up to 1.7.31
• Restrict access to /device/devicePetRelation/getBoundDevices API endpoint
• Implement proper authorization checks for device hardware information access
• Monitor for suspicious activity related to device serial numbers and MAC addresses
• Consider upgrading to a version of Petlibro Smart Pet Feeder Platform beyond 1.7.31
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify the affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations. The information disclosure vulnerability allows unauthorized access to device hardware information by exploiting insecure API endpoints, enabling full device control without proper authorization checks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.