PT-2025-42529 · D Link · D-Link Nuclias Connect

Alex Williams · Published 2025-10-16 · Updated 2025-10-16 · CVE-2025-34255

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions D-Link Nuclias Connect versions 1.3.1.4 and earlier

Description The application’s 'Forgot Password' endpoint exhibits a response discrepancy based on whether the provided email address exists in the system. The endpoint returns different JSON responses, specifically varying the data.exist boolean value, allowing an unauthenticated remote attacker to enumerate valid email addresses and accounts on the server.

Recommendations Update to a version later than 1.3.1.4.

Fix

Weakness Enumeration

CWE-204

Related Identifiers

BDU:2025-13178

CVE-2025-34255

Affected Products

D-Link Nuclias Connect

References · 9

• https://bdu.fstec.ru/vul/2025-13178 · Security Note
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-34255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34255 · Security Note
• https://twitter.com/CVEnew/status/1978926548586496385 · Twitter Post
• https://t.me/CVEtracker/35142 · Telegram Post
• https://dlink.com/en/for-business/nuclias/nuclias-connect · Note
• https://twitter.com/VulmonFeeds/status/1978972031799513464 · Twitter Post
• https://vulncheck.com/advisories/dlink-nuclias-connect-forgot-password-account-enumeration · Note