CVE-2025-34254

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the `error.message`string value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server. NOTE: D-Link states that a fix is under development.

CVSS 4.0

6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-25)

CWE

CWE-204

Published

2025-10-16

Modified

2026-10-09

Record from

the NVD, synced 2026-10-19

Affected

• dlink:nuclias_connect

References

• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
• https://www.dlink.com/en/for-business/nuclias/nuclias-connect
• https://www.vulncheck.com/advisories/dlink-nuclias-connect-login-account-enumeration

Check your stackJSON