2 lines
4.6 KiB
JSON
2 lines
4.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Smart Pet Feeder Platform","vendor":"Petlibrio","versions":[{"lessThanOrEqual":"1.7.31","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:petlibro:petlibro:*:*:*:*:-:*:*:*","matchCriteriaId":"0B604E0A-05A3-46E0-8558-FF3F00F5EF0D","versionEndIncluding":"1.7.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authorization bypass vulnerability that allows unauthorized users to add users as shared owners to any device by exploiting missing permission checks. Attackers can send requests to the device share API to gain unauthorized access to devices and view owner information without proper authorization validation."},{"lang":"es","value":"Las versiones de la plataforma Petlibro Smart Pet Feeder hasta la 1.7.31 contienen una vulnerabilidad de omisión de autorización que permite a usuarios no autorizados añadir usuarios como propietarios compartidos a cualquier dispositivo explotando la falta de comprobaciones de permisos. Los atacantes pueden enviar solicitudes a la API de compartición de dispositivos para obtener acceso no autorizado a los dispositivos y ver la información del propietario sin una validación de autorización adecuada."}],"id":"CVE-2025-3646","lastModified":"2026-10-07T11:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-3646","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-01-05T20:32:23.875187Z","version":"2.0.3"}}]},"published":"2026-01-04T00:15:43.783","references":[{"source":"disclosure@vulncheck.com","tags":["Product"],"url":"https://bobdahacker.com/blog/petlibro"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-authorization-bypass-via-device-share-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
|