CVE-2025-3652 is an information disclosure vulnerability in Petlibrio Smart Pet Feeder Platform up to version 1.7.31. The flaw arises from insecure handling of audio recording assignments via the /device/deviceAudio/use endpoint, where attackers can exploit sequential audio IDs to assign recordings arbitrarily to devices and access private audio URLs belonging to other users. This vulnerability does not require authentication or user interaction and has a CVSS 4.0 base score of 6.9, indicating medium severity.

Unauthorized attackers can access private audio recordings of other users by exploiting predictable audio IDs and insecure assignment endpoints. This leads to a breach of user privacy through disclosure of sensitive audio data. There is no indication of privilege escalation or system compromise beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and monitor for suspicious requests targeting audio assignment functionality. Avoid exposing sequential audio IDs in client requests.