CVE-2025-66974 describes a security issue in the Prolink 13A Smart Plug Model DS-3202M-UKv3 and the mEzee 2.6.7 application. During the provisioning phase, an attacker can supply a crafted packet that causes a Denial of Service or forces the device to connect to a malicious device controlled by the attacker. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (DoS) without confidentiality or integrity loss.

The vulnerability allows remote attackers to disrupt the availability of the smart plug device or redirect its network connection to an attacker-controlled device. This can result in denial of service conditions or potential manipulation of device behavior via the malicious connection. There is no reported impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor vendor communications for updates and avoid exposing the provisioning phase to untrusted networks until a fix is available.