CVE-2025-34255

D-Link Nuclias Connect <= v1.3.1.4 Forgot Password Account Enumeration

State: Published
Severity: 6.9 Medium
Published: Oct 16, 2025
Updated: May 25, 2026
Reserved: Apr 15, 2025

Description

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-204 Observable Response Discrepancy

Affected Products

Product	Versions
Nuclias ConnectD-Link	1.3.1.4 and earlierAffected

References

https://www.vulncheck.com/advisories/dlink-nuclias-connect-forgot-password-account-enumerationthird-party-advisory
https://www.dlink.com/en/for-business/nuclias/nuclias-connectproduct
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.