CVE-2025-34255CWE-204

CVE-2025-34255

Medium · published October 16, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
63.2
In the wild
Unconfirmed
What it is

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01023 · 63.2th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2025-10-16T23:15Z
Affected products (1)
ProductVersionsFixed in
dlink/nuclias_connect≤ 1.3.1.4—
References (3)
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472 · [email protected]https://www.dlink.com/en/for-business/nuclias/nuclias-connect · [email protected]https://www.vulncheck.com/advisories/dlink-nuclias-connect-forgot-password-account-enumeration · [email protected]
EPSS history
Timeline
  • 16 OCT 18:52Z
    D-Link Nuclias Connect <= v1.3.1.4 Forgot Password Account Enumeration
    cvelistv5