CVE-2025-34255

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

An attacker can enumerate valid email addresses and accounts, potentially facilitating further attacks such as phishing or brute force.

Monitor for available updates from D-Link and apply the fix as soon as it is available. In the meantime, consider restricting access to the 'Forgot Password' endpoint.