CVE-2025-34248
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.
Risk Assessment
An authenticated attacker could delete critical system files, potentially leading to system failure or data integrity compromise.
Recommendation
Update D-Link Nuclias Connect to version 1.3.1.4 or later, which includes the fix. Restricting API access to trusted users is recommended.
Other vulnerabilities in D-Link Nuclias Connect
See all- CVE-2025-34255Medium
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.
- CVE-2025-34253Medium
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry.
Original NVD description (English source)
D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS