Executive brief
Petlibro Smart Pet Feeder Platform, a service used to manage IoT pet devices like feeders and cameras, contains a flaw that allows unauthorized access to private audio recordings. Attackers can exploit this to listen to mealtime messages recorded by pet owners, potentially exposing intimate household audio. This vulnerability could lead to privacy violations and the mass harvesting of personal recordings from millions of users.
Technical details
The Petlibro Smart Pet Feeder Platform (up to version 1.7.31) suffers from an information disclosure vulnerability due to insecure direct object references (IDOR) and sequential identifiers. The API endpoint '/device/deviceAudio/use' allows an attacker to assign arbitrary, incrementing audio IDs to any device without verifying ownership. By iterating through these sequential IDs and then querying the device information, an unauthenticated remote attacker can retrieve the direct URLs for private audio recordings belonging to other users. While the vendor has reportedly addressed several related issues, this specific vulnerability was identified alongside a broader set of API security failures including authentication bypasses and unauthorized device hijacking.
Affected products
- Petlibro Smart Pet Feeder Platform up to 1.7.31
Timeline
- 2025-11-05: disclosed: Initial report to vendor by security researcher.
- 2025-12-04: patched: Vendor claimed majority of issues resolved, though some endpoints remained active for legacy support.
- 2026-01-04: advisory: CVE published.