CVE-2025-66974 in 13A Smart Plug
Summary
by MITRE • 09/15/2026
An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Prolink 13A Smart Plug, specifically model DS-3202M-UKv3 running firmware version mEzee 2.6.7 and its associated mobile application, represents a critical security flaw within the device provisioning mechanism. This phase is typically designed to establish secure communication channels between the IoT endpoint and the cloud infrastructure or local network controller by exchanging credentials and configuration parameters. However, the implementation in this specific hardware and software combination fails to adequately validate input data received during this handshake process. An attacker positioned on the same local area network can exploit this weakness by transmitting a specially crafted packet that deviates from expected protocol standards. This malformed input triggers an unintended state transition or resource exhaustion within the device's firmware, leading directly to service disruption.
From a technical perspective, the root cause of this issue lies in insufficient validation and error handling routines during the Wi-Fi provisioning stage. When the smart plug receives data intended for configuration, it does not properly check for buffer overflows, malformed structures, or invalid state transitions before processing them. This lack of sanitization allows an external actor to inject malicious payloads that disrupt normal operation. The consequence is twofold: first, a Denial of Service condition where the device becomes unresponsive and requires a physical reset to restore functionality; second, a more severe risk involving connection hijacking or redirection. By manipulating the provisioning packets, an attacker may force the device to connect to a rogue access point or server controlled by them, effectively intercepting traffic or gaining unauthorized control over the smart plug's operations.
The operational impact of this vulnerability is significant for users relying on these devices for home automation and energy monitoring. A successful Denial of Service attack renders the IoT device useless until it is manually rebooted, causing inconvenience and potential safety issues if the plugged-in appliance controls critical systems such as heating or security alarms. More critically, the ability to redirect connections poses a severe privacy and security threat. If an attacker can manipulate the provisioning process to establish a connection with their own server, they may be able to exfiltrate sensitive network data, including Wi-Fi credentials stored on the device for future reconnection attempts. This creates a persistent backdoor that could facilitate further lateral movement within the home network or lead to botnet recruitment if the compromised devices are not properly secured against such manipulation.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption, which describe failures in checking incoming data for correctness and limits on resource usage respectively. In terms of the MITRE ATT&CK framework, this exploit technique relates to T1595 Active Scanning or potentially T1133 External Remote Services if it facilitates unauthorized access through manipulated connections. To mitigate these risks, users should immediately update the mEzee application and device firmware to any patched versions released by Prolink that address input validation during provisioning. Network administrators should segment IoT devices on a separate VLAN with restricted internet access to limit the blast radius of potential compromises. Additionally, disabling Wi-Fi setup modes when not actively configuring new devices can reduce the window of exposure to such attacks until permanent software fixes are applied.