Is CVE-2025-3652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-3652 being exploited in the wild.

How severe is CVE-2025-3652?

Medium severity, with a CVSS score of 5.3, published 4 January 2026.

Which products and versions are affected?

Petlibro Smart Pet Feeder Platform up to 1.7.31.

Is there a fix for CVE-2025-3652?

A patch was published on 2025-12-04: Vendor claimed majority of issues resolved, though some endpoints remained active for legacy support. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-3652 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-3652?

Check whether you run Petlibro or Petlibro Smart Pet Feeder Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-3652: Petlibro Smart Pet Feeder Platform information disclosure in audio recordings

CVE-2025-3652 · Severity: medium · CVSS 5.3 · Published 2026-01-04

Petlibro Smart Pet Feeder Platform, a service used to manage IoT pet devices like feeders and cameras, contains a flaw that allows unauthorized access to private audio recordings. Attackers can exploit this to listen to mealtime messages recorded by pet owners, potentially exposing intimate household audio. This vulnerability could lead to privacy violations and the mass harvesting of personal recordings from millions of users.

Technologies: Petlibro, Petlibro Smart Pet Feeder Platform. Vendors: Petlibro.

Quick answers

Is CVE-2025-3652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-3652 being exploited in the wild.
How severe is CVE-2025-3652?: Medium severity, with a CVSS score of 5.3, published 4 January 2026.
Which products and versions are affected?: Petlibro Smart Pet Feeder Platform up to 1.7.31.
Is there a fix for CVE-2025-3652?: A patch was published on 2025-12-04: Vendor claimed majority of issues resolved, though some endpoints remained active for legacy support. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-3652 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-3652?: Check whether you run Petlibro or Petlibro Smart Pet Feeder Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Petlibro Smart Pet Feeder Platform (up to version 1.7.31) suffers from an information disclosure vulnerability due to insecure direct object references (IDOR) and sequential identifiers. The API endpoint '/device/deviceAudio/use' allows an attacker to assign arbitrary, incrementing audio IDs to any device without verifying ownership. By iterating through these sequential IDs and then querying the device information, an unauthenticated remote attacker can retrieve the direct URLs for private audio recordings belonging to other users. While the vendor has reportedly addressed several related issues, this specific vulnerability was identified alongside a broader set of API security failures including authentication bypasses and unauthorized device hijacking.

Affected products

Petlibro Smart Pet Feeder Platform up to 1.7.31

Timeline

2025-11-05: disclosed: Initial report to vendor by security researcher.
2025-12-04: patched: Vendor claimed majority of issues resolved, though some endpoints remained active for legacy support.
2026-01-04: advisory: CVE published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.