CVE-2025-34248CWE-22path-traversal

CVE-2025-34248

published October 10, 2025

CVSS
7.2
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.

The record
Technical detail
CVSS
7.2 · NONE
CVSS v4.0
Not supplied
EPSS
0.00650 · 50.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-10T01:15Z
References (3)
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472 · [email protected]https://www.dlink.com/en/for-business/nuclias/nuclias-connect · [email protected]https://www.vulncheck.com/advisories/dlink-nuclias-connect-directory-traversal-to-arbitrary-file-deletion · [email protected]
EPSS history
Timeline
  • 09 OCT 20:43Z
    D-Link Nuclias Connect < v1.3.1.4 Directory Traversal to Arbitrary File Deletion
    cvelistv5