What is the CVSS score of EUVD-2026-108204?

EUVD-2026-108204 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-108204?

Within 24 hours, inventory all AiDot Linkind Matter Smart Plug devices running firmware 1.01.32 and isolate them on a dedicated VLAN or network segment with strict access controls; disable UPnP and SSDP (UDP port 1900) on the plugs and on network gateways if operationally feasible; monitor for anomalous SSDP traffic or device reboots. Within 7 days, engage the vendor to obtain patch status, timeline, and interim mitigations, and evaluate replacing the plugs with alternative models that have a supported security update process. Within 30 days, if no patch is released, implement network segmentation for all IoT devices, restrict inbound and outbound traffic to ensure plugs cannot be reached from untrusted segments, and develop a migration plan to eliminate affected devices from the environment; continue to monitor for exploit activity and vendor advisories.

AiDot Linkind Plug EUVD-2026-108204

| CVE-2026-78846 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-10-22 mitre

GHSA-h523-c37q-v8g3

Buffer Overflow Heap Overflow

9.8

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local network access
Exploit

Send crafted SSDP header to plug
Execution

Overflow heap buffer in parser
Impact

Execute code on device

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires the attacker to be able to send SSDP/UPnP traffic (UDP port 1900, typically link-local multicast/unicast) to a plug running firmware 1.01.32 - in practice, a position on the same local network segment as the device. No authentication and no user interaction are required (PR:N/UI:N), so any LAN-resident host can trigger it against a default configuration. The primary LIMITING factor is network adjacency: SSDP is a local-discovery protocol, so despite the AV:N rating the flaw is not exploitable directly from the internet without a prior LAN foothold or exposed/forwarded UPnP service. Exploitation is tied to the specific affected firmware version 1.01.32.
Impact	Signals conflict and must be weighed carefully. The NVD CVSS 3.1 vector (9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) rates this a critical, unauthenticated, low-complexity remote heap overflow, and the vuln.today Decision label is 'act_now'. However, the mechanism - a buffer overflow in SSDP local header parsing - points to a link-local UPnP/SSDP protocol (UDP/1900) that is normally confined to a LAN segment, which contradicts the AV:N (network) rating; the practical attack surface is adjacent-network, not internet-wide. This should be verified, but it materially lowers real-world exposure versus the raw 9.8. EPSS is low at 0.19% (8th percentile), indicating no modeled likelihood of widespread opportunistic exploitation, and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists (GitHub, 0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities) but it is not verified as working exploit code. Net: a genuinely severe device-takeover flaw for anyone already on the same local network as the plug, but low mass-exploitation risk given the LAN-bound protocol and the niche consumer-IoT footprint. The 'act_now' label is driven by severity class rather than evidence of in-the-wild use.
Exploit ScenarioDerived	An attacker who has gained a foothold on the same local network as the smart plug (e.g., a compromised home device or guest Wi-Fi) sends a crafted SSDP/UPnP discovery message with a malformed header to the plug running firmware 1.01.32, overflowing a heap buffer in the header parser. Because no authentication or user interaction is required, this can yield code execution on the device, giving the attacker control of the plug and a persistent LAN foothold. A public PoC reference exists but is not verified as working exploit code.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 28, 2026

Heap-based buffer overflow in AiDot Linkind Matter Smart Plug firmware 1.01.32 allows unauthenticated attackers positioned on the same local network segment to corrupt heap memory through crafted SSDP header parsing, with high confidentiality, integrity, and availability impact. The vendor-facing CVSS of 9.8 uses AV:N, but the independently assessed vector is AV:A because SSDP is a local-discovery protocol-internet exploitation requires a prior LAN foothold or an exposed or forwarded UPnP service on UDP port 1900. No CISA KEV entry or verified working exploit code is present in the supplied data; a public GitHub repository documents the SSDP/UPnP issues, and EPSS is low at 0.19% (8th percentile).

RemediationAI

No vendor-released patch or fixed firmware version is identified in the supplied data for AiDot Linkind Matter Smart Plug firmware 1.01.32; the vendor disclosure policy is at https://www.aidot.com/vulnerability-disclosure-policy and technical details are documented at https://github.com/0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities and https://vuldb.com/vuln/425312. Until a fix is available, isolate the plugs on a dedicated IoT VLAN or SSID with client isolation so LAN-resident hosts cannot reach UDP port 1900 on the devices; the trade-off is that other local discovery and control integrations may break. Block inbound and outbound SSDP/UPnP traffic, including UDP 1900 and related multicast, at network boundaries and disable UPnP/SSDP exposure or WAN forwarding on routers, with the trade-off that smart-home discovery, casting, and automatic port mapping stop working. If isolation is not possible, restrict which hosts may send to the devices' SSDP port and monitor for malformed SSDP traffic; these are compensating controls only, and installing vendor firmware when a fixed version is published remains the complete fix.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-122 (heap-based buffer overflow) affects the SSDP/UPnP discovery service in AiDot Linkind Matter Smart Plug firmware 1.01.32. SSDP runs over UDP port 1900 and uses link-local multicast, typically 239.255.255.250, for local discovery; the device parses SSDP headers from received messages, and insufficient bounds checking on a heap-allocated buffer permits writes beyond its bounds. The supplied sources do not identify the specific header field, parsing routine, or allocation size, so the exact trigger is not described in the available sources. The CPE string is n/a and the EUVD affected-version field is n/a, so product and version scoping come from the description and the EUVD record rather than structured CPE data. The assessed vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that any LAN-resident host can send malformed SSDP traffic without authentication or user interaction, while the vendor's AV:N rating does not account for SSDP's local-only reachability.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

SSDP header parsing is a link-local protocol, so AV:A rather than AV:N; no auth or interaction (PR:N/UI:N), low complexity, and heap overflow enables full device compromise (C/I/A:H).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Oct 26, 2026 - 20:22 NVD

9.8 (CRITICAL)

CVE Published

Oct 22, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Oct 22, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header parsing.

Executive ViewAI

Why It Matters

A critical heap-based buffer overflow in AiDot Linkind Matter Smart Plug firmware version 1.01.32 can be triggered by unauthenticated attackers on the same local network segment, leading to potential full compromise of the device's confidentiality, integrity, and availability. While exploitation requires local network access, any LAN foothold-such as a compromised employee device or guest Wi-Fi-could enable an attacker to disrupt smart plug operations or pivot to other connected systems. The lack of a vendor patch and the presence of publicly documented SSDP/UPnP issues warrant immediate leadership attention to mitigate exposure across all deployed units.

Business Impact: High

Compensating Controls

Apply vendor patch. If unavailable, isolate affected devices on a dedicated VLAN, disable UPnP/SSDP, restrict inbound and outbound traffic, monitor for anomalous SSDP activity, and replace devices with supported alternatives if the vendor does not release a patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Prevalence

Low

niche consumer smart-plug brand, no enterprise footprint

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.