Is CVE-2025-3646 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-3646 being exploited in the wild.

How severe is CVE-2025-3646?

High severity, with a CVSS score of 7.3, published 4 January 2026.

Which products and versions are affected?

Petlibro Smart Pet Feeder Platform up to 1.7.31.

Is there a fix for CVE-2025-3646?

A patch was published on 2025-12-04: Vendor claimed majority of issues resolved in latest app version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-3646 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-3646?

Check whether you run Petlibro or Petlibro Smart Pet Feeder Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-3646: Petlibro Smart Pet Feeder Platform authorization bypass in device share API

CVE-2025-3646 · Severity: high · CVSS 7.3 · Published 2026-01-04

Petlibro's smart pet feeder platform, used to manage automated feeding and monitoring devices, contains a security flaw in its sharing system. An unauthorized person can exploit this to add themselves as a 'shared owner' to any device without the real owner's permission. This allows an attacker to gain control over pet feeders, view owner information, and potentially access camera feeds or feeding schedules, posing a significant privacy and safety risk to pet owners.

Technologies: Petlibro, Petlibro Smart Pet Feeder Platform. Vendors: Petlibro.

Quick answers

Is CVE-2025-3646 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-3646 being exploited in the wild.
How severe is CVE-2025-3646?: High severity, with a CVSS score of 7.3, published 4 January 2026.
Which products and versions are affected?: Petlibro Smart Pet Feeder Platform up to 1.7.31.
Is there a fix for CVE-2025-3646?: A patch was published on 2025-12-04: Vendor claimed majority of issues resolved in latest app version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-3646 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-3646?: Check whether you run Petlibro or Petlibro Smart Pet Feeder Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Petlibro Smart Pet Feeder Platform's device share API due to a lack of server-side authorization checks (CWE-306). An unauthenticated remote attacker can send a crafted request to the sharing endpoint to add any user account as a shared owner of a target device. This bypasses the intended permission model, granting the attacker unauthorized access to device controls, serial numbers, and owner metadata. While the vendor has reportedly introduced a fix in newer versions, the vulnerability persists in legacy endpoints maintained for backward compatibility. An attacker can leverage this to hijack device functionality, including manual feeding triggers and camera access.

Affected products

Petlibro Smart Pet Feeder Platform up to 1.7.31

Timeline

2025-11-05: disclosed: Vulnerability reported to vendor by researcher
2025-12-04: patched: Vendor claimed majority of issues resolved in latest app version
2026-01-03: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.