CVE-2025-34253

MediumCVSS 5.4

Published: 16/10/2025(UTC)Updated: 05/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

43th percentile - higher than 43% of all known CVEs

Summary

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry.

Risk Assessment

An attacker can steal credentials, hijack user sessions, or perform unauthorized actions in the context of other administrators, threatening the security of the entire network infrastructure.

Recommendation

It is recommended to monitor D-Link for patch information and apply it as soon as available, and restrict access to the administrative panel to trusted users only.

Other vulnerabilities in D-Link Nuclias Connect

CVE-2025-34255Medium
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS