CVE-2025-3654: Petlibro Pet Feeder Information Disclosure

CVE-2025-3654 Overview

CVE-2025-3654 is an information disclosure vulnerability affecting Petlibro Smart Pet Feeder Platform versions up to 1.7.31. The vulnerability allows unauthorized access to device hardware information by exploiting insecure API endpoints. Attackers can retrieve device serial numbers and MAC addresses through the /device/devicePetRelation/getBoundDevices endpoint using pet IDs, enabling full device control without proper authorization checks.

Critical Impact
Unauthorized attackers can obtain sensitive device information including serial numbers and MAC addresses, potentially enabling full control of smart pet feeders without authentication.

Affected Products

Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Discovery Timeline

2026-01-04 - CVE CVE-2025-3654 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-3654

Vulnerability Analysis

This vulnerability is classified under CWE-612 (Improper Authorization of Index Containing Sensitive Information). The Petlibro Smart Pet Feeder Platform fails to implement proper authorization checks on API endpoints that return sensitive device information. The /device/devicePetRelation/getBoundDevices endpoint accepts pet IDs as input parameters and returns bound device information without verifying whether the requesting user has legitimate access to that data.

The platform's API design allows any user who knows or can enumerate pet IDs to retrieve hardware details of associated smart pet feeders. This architectural flaw exposes device serial numbers and MAC addresses to unauthorized parties, which are critical identifiers that can be leveraged to assume control of IoT devices on the platform.

Root Cause

The root cause of this vulnerability lies in the absence of proper authorization controls on the API endpoint /device/devicePetRelation/getBoundDevices. The platform fails to validate that the requesting user owns or has permission to access information about devices associated with a given pet ID. This represents an Insecure Direct Object Reference (IDOR) pattern where internal object references (pet IDs) are directly exposed without access control verification.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send requests to the vulnerable API endpoint with arbitrary or enumerated pet IDs to retrieve device information. Once serial numbers and MAC addresses are obtained, an attacker can potentially:

Register the device under their own account
Monitor or control the pet feeder remotely
Gather intelligence for further attacks against the device owner's network
Enumerate additional devices across the platform by iterating through pet IDs

The vulnerability is particularly concerning for IoT devices as it exposes hardware identifiers that are typically considered sensitive and can be used to bypass device authentication mechanisms.

Detection Methods for CVE-2025-3654

Indicators of Compromise

Unusual API request patterns targeting /device/devicePetRelation/getBoundDevices endpoint
High volume of requests with sequential or enumerated pet ID parameters from single IP addresses
Access logs showing requests for device information from users who do not own those devices
Anomalous geographic locations for API requests compared to registered device locations

Detection Strategies

Monitor API access logs for requests to the /device/devicePetRelation/getBoundDevices endpoint
Implement rate limiting and anomaly detection on API endpoints returning device information
Alert on requests where the authenticated user does not match the owner of the requested pet ID
Deploy network-level monitoring to identify enumeration attack patterns

Monitoring Recommendations

Enable detailed logging on all API endpoints handling device information
Configure alerts for failed authorization attempts or access to unauthorized resources
Implement behavioral analysis to detect unusual access patterns to device-related endpoints
Review API access patterns regularly for signs of reconnaissance or data harvesting activities

How to Mitigate CVE-2025-3654

Immediate Actions Required

Upgrade Petlibro Smart Pet Feeder Platform to a version newer than 1.7.31 when available
Implement network-level access controls to limit API access to trusted sources
Monitor API logs for signs of exploitation or unauthorized access attempts
Consider temporarily disabling or restricting access to the vulnerable endpoint if possible

Patch Information

Users should monitor for security updates from Petlibro and apply patches as soon as they become available. Additional technical details can be found in the Bob Da Hacker Blog Post and the VulnCheck Security Advisory.

Workarounds

Implement additional network segmentation to isolate IoT devices from critical infrastructure
Deploy a Web Application Firewall (WAF) with rules to detect and block enumeration attempts
Use network monitoring tools to detect and alert on suspicious API access patterns
Consider disabling remote access to the pet feeder until a patch is available
Rotate device credentials and monitor for unauthorized device access