CVE-2025-34253
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript executed in the context of other users viewing the profile entry.
Risk Assessment
An authenticated attacker can execute arbitrary JavaScript in the browsers of other administrative panel users, potentially hijacking their sessions. The risk affects D-Link Nuclias Connect devices with firmware <= 1.3.1.4.
Recommendation
Update D-Link Nuclias Connect firmware to version 1.3.1.5 or later. Restrict administrative panel access to trusted networks.
Other vulnerabilities in D-Link Nuclias Connect
See all- CVE-2025-34255Medium
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.
- CVE-2025-34254Medium
D-Link Nuclias Connect firmware versions up to 1.3.1.4 contain an observable response discrepancy vulnerability. The 'Login' endpoint returns distinct JSON responses depending on whether the username exists. An unauthenticated remote attacker can enumerate valid usernames.
- CVE-2025-34248High
D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.
Original NVD description (English source)
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link fixed this issue in version 1.3.1.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS