CVE-2025-66974

Deferred Deferred - Pending Action

Prolink Smart Plug DoS via Crafted Provisioning Packet

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: MITRE

Description

An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2025-66974

EUVD

EUVD-2025-210914

Affected Vendors & Products

Vendor	Product	Version / Range
prolink	13a_smart_plug	to 2.6.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Prolink 13A Smart Plug (Model: DS-3202M-UKv3) during Wi-Fi provisioning. It involves a lack of verification to bind a legitimate user's application authentication token to the smart plug. Attackers can capture provisioning packets and replay them with their own token, causing the smart plug to connect to the attacker's account instead of the legitimate user's.

Detection Guidance

To detect CVE-2025-66974 on your network, monitor for unusual Wi-Fi provisioning traffic involving the Prolink 13A Smart Plug. Check for repeated or malformed packets during the provisioning phase, as attackers may replay captured packets. Use network sniffing tools like Wireshark to inspect packets for mismatched authentication tokens or unexpected device associations.

Impact Analysis

If exploited, this vulnerability allows unauthorized control of your smart plug. An attacker could turn the plug on or off, disrupting devices connected to it. They might also gain access to your network if the plug is connected internally, potentially leading to further compromise of other devices.

Compliance Impact

The vulnerability in the Prolink 13A Smart Plug allows unauthorized control of the device due to improper authentication during provisioning. This could lead to unauthorized access to connected systems, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is involved.

Mitigation Strategies

Update the Prolink 13A Smart Plug firmware to the latest version to address the lack of token binding during provisioning. Avoid using the smart plug's provisioning process on untrusted networks to prevent packet capture and replay attacks.

Hi! I’m here to help you understand CVE-2025-66974. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70