CVE-2025-34254
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
D-Link Nuclias Connect firmware versions up to 1.3.1.4 contain an observable response discrepancy vulnerability. The 'Login' endpoint returns distinct JSON responses depending on whether the username exists. An unauthenticated remote attacker can enumerate valid usernames.
Risk Assessment
An attacker can obtain a list of valid accounts, facilitating brute-force or phishing attacks.
Recommendation
Monitor access to the login endpoint and consider limiting login attempts. The vendor is working on a fix.
Other vulnerabilities in D-Link Nuclias Connect
See all- CVE-2025-34255Medium
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.
- CVE-2025-34253Medium
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry.
- CVE-2025-34248High
D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.
Original NVD description (English source)
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the `error.message`string value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server. NOTE: D-Link states that a fix is under development.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS