CVE-2025-34255
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.
Risk Assessment
An attacker can enumerate valid email addresses and accounts, potentially facilitating further attacks such as phishing or brute force.
Recommendation
Monitor for available updates from D-Link and apply the fix as soon as it is available. In the meantime, consider restricting access to the 'Forgot Password' endpoint.
Other vulnerabilities in D-Link Nuclias Connect
See all- CVE-2025-34254Medium
D-Link Nuclias Connect firmware versions up to 1.3.1.4 contain an observable response discrepancy vulnerability. The 'Login' endpoint returns distinct JSON responses depending on whether the username exists. An unauthenticated remote attacker can enumerate valid usernames.
- CVE-2025-34253Medium
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript executed in the context of other users viewing the profile entry.
- CVE-2025-34248High
D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.
Original NVD description (English source)
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS