PT-2025-41465 · D Link · D-Link Nuclias Connect

Alex Williams · Published 2025-10-09 · Updated 2025-10-10 · CVE-2025-34248

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link Nuclias Connect versions prior to 1.3.1.4

Description The software contains a directory traversal issue in the /api/web/dnc/global/database/deleteBackup endpoint. This is due to insufficient input validation of the deleteBackupList parameter. A successful exploit by an authenticated attacker could lead to the deletion of arbitrary files, potentially compromising system integrity and availability.

Recommendations Update to version 1.3.1.4 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-12883

CVE-2025-34248

Affected Products

D-Link Nuclias Connect

References · 8

• https://bdu.fstec.ru/vul/2025-12883 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-34248 · Security Note
• https://dlink.com/en/for-business/nuclias/nuclias-connect · Note
• https://vuldb.com/?id.327814 · Note
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472 · Patch, Vendor Advisory
• https://vulncheck.com/advisories/dlink-nuclias-connect-directory-traversal-to-arbitrary-file-deletion · Note
• https://twitter.com/CVEnew/status/1976396265568227797 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1976566296817869113 · Twitter Post