CVE-2025-3652

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description The Petlibro Smart Pet Feeder Platform is affected by an information disclosure issue. This allows unauthorized access to private audio recordings. The issue stems from exploiting sequential audio IDs and insecure assignment endpoints. Attackers can send requests to the /device/deviceAudio/use API endpoint with arbitrary audio IDs to assign recordings to any device. Subsequently, attackers can retrieve audio URLs to access recordings belonging to other users. The vulnerable parameter is the audio ID used in the request to the /device/deviceAudio/use endpoint.

Recommendations Update to a version later than 1.7.31.