CVE-2025-3654 is an information disclosure vulnerability in Petlibro Smart Pet Feeder Platform versions up to 1.7.31. It results from improper authorization on the API endpoint /device/devicePetRelation/getBoundDevices, which allows attackers to retrieve sensitive device hardware information such as serial numbers and MAC addresses by supplying pet IDs. This lack of authorization checks can lead to unauthorized device control. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9. No patch or vendor advisory has been provided to confirm remediation status.

Unauthorized attackers can access sensitive device hardware information including serial numbers and MAC addresses without authentication. This information disclosure could facilitate further attacks, including unauthorized control of the affected smart pet feeder devices. The vulnerability does not require user interaction or privileges and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected API endpoints where possible and monitor for unauthorized access attempts. Avoid exposing the device management interfaces to untrusted networks.