CVE-2025-34255

low-risk
Published 2025-10-16

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Nuclias Connect

Affected Vendors

Dlink

References (3)

Vendor Advisory https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
Product https://www.dlink.com/en/for-business/nuclias/nuclias-connect
Third Party Advisory https://www.vulncheck.com/advisories/dlink-nuclias-connect-forgot-password-accou...
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal