CVE-2025-3660 Petlibro CVE debrief

Who should care

Users of Petlibro Smart Pet Feeder Platform versions up to 1.7.31 should be aware of this broken access control vulnerability. Operators of the platform, vulnerability management teams, and security teams should review the official advisory and CVE record for affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

CVE-2025-3660 is a broken access control vulnerability in Petlibro Smart Pet Feeder Platform versions up to 1.7.31. Authenticated users can access other users' pet data by exploiting missing ownership verification, allowing retrieval of sensitive information including pet details, member IDs, and avatar URLs. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Users of the platform should verify and limit access to the /member/pet/detailV2 endpoint and implement proper authorization checks for pet data retrieval.

Defensive priority

Medium priority due to CVSS score of 6.9 and potential for sensitive information disclosure.

Recommended defensive actions

• Verify and limit access to the /member/pet/detailV2 endpoint
• Implement proper authorization checks for pet data retrieval
• Update Petlibro Smart Pet Feeder Platform to version above 1.7.31 if available
• Monitor for suspicious activity related to pet data access
• Conduct regular security audits and penetration testing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail provide information about the vulnerability. Limited additional information is available from the source item and references. Evidence limits suggest verifying the Petlibro Smart Pet Feeder Platform versions up to 1.7.31 for potential exposure. Defenders should review the official advisory and CVE record for affected scope, severity, and vendor guidance. They should also monitor for suspicious activity related to pet data access and conduct regular security audits and penetration testing.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.