CVE-2025-3654: Petlibro Pet Feeder Information Disclosure

CVE-2025-3654 Overview

CVE-2025-3654 is an information disclosure vulnerability affecting Petlibro Smart Pet Feeder Platform versions up to 1.7.31. The vulnerability allows unauthorized access to device hardware information by exploiting insecure API endpoints. Attackers can retrieve device serial numbers and MAC addresses through the /device/devicePetRelation/getBoundDevices endpoint using pet IDs, enabling full device control without proper authorization checks.

Critical Impact

Unauthorized attackers can obtain sensitive device information including serial numbers and MAC addresses, potentially enabling full control of smart pet feeders without authentication.

Affected Products

• Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Discovery Timeline

• 2026-01-04 - CVE CVE-2025-3654 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-3654

Vulnerability Analysis

This vulnerability is classified under CWE-612 (Improper Authorization of Index Containing Sensitive Information). The Petlibro Smart Pet Feeder Platform fails to implement proper authorization checks on API endpoints that return sensitive device information. The /device/devicePetRelation/getBoundDevices endpoint accepts pet IDs as input parameters and returns bound device information without verifying whether the requesting user has legitimate access to that data.

The platform's API design allows any user who knows or can enumerate pet IDs to retrieve hardware details of associated smart pet feeders. This architectural flaw exposes device serial numbers and MAC addresses to unauthorized parties, which are critical identifiers that can be leveraged to assume control of IoT devices on the platform.

Root Cause

The root cause of this vulnerability lies in the absence of proper authorization controls on the API endpoint /device/devicePetRelation/getBoundDevices. The platform fails to validate that the requesting user owns or has permission to access information about devices associated with a given pet ID. This represents an Insecure Direct Object Reference (IDOR) pattern where internal object references (pet IDs) are directly exposed without access control verification.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send requests to the vulnerable API endpoint with arbitrary or enumerated pet IDs to retrieve device information. Once serial numbers and MAC addresses are obtained, an attacker can potentially:

1. Register the device under their own account
2. Monitor or control the pet feeder remotely
3. Gather intelligence for further attacks against the device owner's network
4. Enumerate additional devices across the platform by iterating through pet IDs

The vulnerability is particularly concerning for IoT devices as it exposes hardware identifiers that are typically considered sensitive and can be used to bypass device authentication mechanisms.

Detection Methods for CVE-2025-3654

Indicators of Compromise

• Unusual API request patterns targeting /device/devicePetRelation/getBoundDevices endpoint
• High volume of requests with sequential or enumerated pet ID parameters from single IP addresses
• Access logs showing requests for device information from users who do not own those devices
• Anomalous geographic locations for API requests compared to registered device locations

Detection Strategies

• Monitor API access logs for requests to the /device/devicePetRelation/getBoundDevices endpoint
• Implement rate limiting and anomaly detection on API endpoints returning device information
• Alert on requests where the authenticated user does not match the owner of the requested pet ID
• Deploy network-level monitoring to identify enumeration attack patterns

Monitoring Recommendations

• Enable detailed logging on all API endpoints handling device information
• Configure alerts for failed authorization attempts or access to unauthorized resources
• Implement behavioral analysis to detect unusual access patterns to device-related endpoints
• Review API access patterns regularly for signs of reconnaissance or data harvesting activities

How to Mitigate CVE-2025-3654

Immediate Actions Required

• Upgrade Petlibro Smart Pet Feeder Platform to a version newer than 1.7.31 when available
• Implement network-level access controls to limit API access to trusted sources
• Monitor API logs for signs of exploitation or unauthorized access attempts
• Consider temporarily disabling or restricting access to the vulnerable endpoint if possible

Patch Information

Users should monitor for security updates from Petlibro and apply patches as soon as they become available. Additional technical details can be found in the Bob Da Hacker Blog Post and the VulnCheck Security Advisory.

Workarounds

• Implement additional network segmentation to isolate IoT devices from critical infrastructure
• Deploy a Web Application Firewall (WAF) with rules to detect and block enumeration attempts
• Use network monitoring tools to detect and alert on suspicious API access patterns
• Consider disabling remote access to the pet feeder until a patch is available
• Rotate device credentials and monitor for unauthorized device access