Security readout for executives and security teams
Plain-English summary
This vulnerability could let someone sign into Petlibro smart pet feeder accounts without owning the account. The issue is in the platform’s social-login validation, not in a user’s password hygiene. Successful access could expose account data and allow account-level actions, but the supplied sources do not document active exploitation.
Executive priority
Prioritize awareness and exposure review, especially where pet feeder accounts are tied to executives, facilities, or shared households. Business urgency is moderate unless affected accounts contain sensitive data or device control has operational impact.
Technical view
CVE-2025-15115 is an authentication bypass in Petlibro Smart Pet Feeder Platform through 1.7.31. The reported flaw is improper authorization/OAuth validation in social login, mapped to CWE-862. CVSS v4.0 is 6.9, with network access, low complexity, no privileges, and no user interaction required.
Likely exposure
Exposure is limited to users or organizations with Petlibro smart feeder accounts on affected platform versions. The source bundle does not prove which backend deployments remain vulnerable or whether a vendor-side fix is available.
Exploitation context
CISA KEV status is false, and the provided sources do not state active exploitation. The described weakness is remotely reachable and unauthenticated, so exploitability should be taken seriously even though real-world abuse is unconfirmed.
Researcher notes
The record has useful CVSS and CWE detail, but affected-version metadata appears inconsistent with the title and description. Treat the platform-through-1.7.31 claim as advisory evidence and seek vendor confirmation before asserting remediation status.
Mitigation direction
- Check Petlibro or VulnCheck guidance for fixed platform or app versions.
- Update Petlibro mobile apps and device firmware when updates are available.
- Remove unnecessary linked social-login accounts where possible.
- Avoid storing sensitive personal data in affected accounts.
- Monitor account activity for unfamiliar devices, sessions, or profile changes.
Validation and detection
- Inventory Petlibro smart feeder accounts and app versions in use.
- Confirm whether accounts use social-login flows affected by the advisory.
- Review vendor notices for patch status and affected backend scope.
- Check account login history or device associations for unexpected access.
- Track CVE Program and advisory updates for corrected affected-version data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-15115 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5VulnCheckVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Security Research: Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who AsksCVE reference, VulnCheck · third-party-advisory, technical-description
- VulnCheck Advisory: Petlibro Smart Pet Feeder Platform through 1.7.31 Authentication Bypass via API endpointCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.