Is CVE-2025-3653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-3653 being exploited in the wild.

How severe is CVE-2025-3653?

High severity, with a CVSS score of 7.3, published 4 January 2026.

Which products and versions are affected?

Petlibro Smart Pet Feeder Platform up to 1.7.31.

Is there a fix for CVE-2025-3653?

A patch was published on 2025-12-04: Vendor claimed majority of issues resolved, though legacy auth endpoint remained active. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-3653 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-3653?

Check whether you run Petlibro or Petlibro Smart Pet Feeder Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-3653: Petlibro Smart Pet Feeder improper access control in API

CVE-2025-3653 · Severity: high · CVSS 7.3 · Published 2026-01-04

Petlibro smart pet feeders, which allow owners to remotely feed and monitor pets, suffer from a security flaw that allows unauthorized control of the devices. An attacker can remotely change feeding schedules, trigger manual feedings, and access live camera feeds or private audio recordings. This could lead to pet health issues if feeding is disrupted or a significant invasion of privacy within the home.

Technologies: Petlibro, Petlibro Smart Pet Feeder Platform. Vendors: Petlibro.

Quick answers

Is CVE-2025-3653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-3653 being exploited in the wild.
How severe is CVE-2025-3653?: High severity, with a CVSS score of 7.3, published 4 January 2026.
Which products and versions are affected?: Petlibro Smart Pet Feeder Platform up to 1.7.31.
Is there a fix for CVE-2025-3653?: A patch was published on 2025-12-04: Vendor claimed majority of issues resolved, though legacy auth endpoint remained active. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-3653 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-3653?: Check whether you run Petlibro or Petlibro Smart Pet Feeder Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Petlibro Smart Pet Feeder Platform (up to version 1.7.31) fails to perform ownership verification on several API endpoints, most notably those handling device control and pet data. By supplying a valid device serial number to the device control APIs, an unauthenticated attacker can modify feeding schedules, trigger manual feeds, and access camera streams. Serial numbers and MAC addresses can be harvested via the /device/devicePetRelation/getBoundDevices endpoint using a pet ID, which itself is accessible via the /member/pet/detailV2 endpoint without authorization checks. Additionally, the platform is susceptible to account takeover via a legacy social login endpoint (/member/auth/thirdLogin) that accepts Google IDs without verifying OAuth tokens.

Affected products

Petlibro Smart Pet Feeder Platform up to 1.7.31

Timeline

2025-11-05: disclosed: Initial report to vendor by researcher BobDaHacker.
2025-12-04: patched: Vendor claimed majority of issues resolved, though legacy auth endpoint remained active.
2026-01-03: advisory: CVE published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.