CVE-2025-34254CWE-204

CVE-2025-34254

Medium · published October 16, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
63.2
In the wild
Unconfirmed
What it is

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the `error.message`string value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server. NOTE: D-Link states that a fix is under development.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01023 · 63.2th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2025-10-16T23:15Z
Affected products (1)
ProductVersionsFixed in
dlink/nuclias_connect≤ 1.3.1.4—
References (3)
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472 · [email protected]https://www.dlink.com/en/for-business/nuclias/nuclias-connect · [email protected]https://www.vulncheck.com/advisories/dlink-nuclias-connect-login-account-enumeration · [email protected]
EPSS history
Timeline
  • 16 OCT 18:52Z
    D-Link Nuclias Connect <= v1.3.1.4 Login Account Enumeration
    cvelistv5