CVE-2025-66974
Received Received - Intake

Prolink Smart Plug DoS via Crafted Provisioning Packet

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: MITRE

Description
An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2025-66974
EUVD
EUVD-2025-210914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
prolink 13a_smart_plug to 2.6.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Prolink 13A Smart Plug (Model: DS-3202M-UKv3) during Wi-Fi provisioning. It involves a lack of verification to bind a legitimate user's application authentication token to the smart plug. Attackers can capture provisioning packets and replay them with their own token, causing the smart plug to connect to the attacker's account instead of the legitimate user's.

Impact Analysis

If exploited, this vulnerability allows unauthorized control of your smart plug. An attacker could turn the plug on or off, disrupting devices connected to it. They might also gain access to your network if the plug is connected internally, potentially leading to further compromise of other devices.

Mitigation Strategies

Update the Prolink 13A Smart Plug firmware to the latest version to address the lack of token binding during provisioning. Avoid using the smart plug's provisioning process on untrusted networks to prevent packet capture and replay attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66974. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart