CVE-2025-34255

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

CVSS 4.0

6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-25)

CWE

CWE-204

Published

2025-10-16

Modified

2026-10-09

Record from

the NVD, synced 2026-10-19

Affected

• dlink:nuclias_connect

References

• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
• https://www.dlink.com/en/for-business/nuclias/nuclias-connect
• https://www.vulncheck.com/advisories/dlink-nuclias-connect-forgot-password-account-enumeration

Check your stackJSON