CVE-2025-34254

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the `error.message`string value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server. NOTE: D-Link states that a fix is under development.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472	Vendor Advisory
https://www.dlink.com/en/for-business/nuclias/nuclias-connect	Product
https://www.vulncheck.com/advisories/dlink-nuclias-connect-login-account-enumeration	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dlink:nuclias_connect:*:*:*:*:*:*:*:*

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Versiones de firmware de D-Link Nuclias Connect menor o igual que 1.3.1.4 contienen una vulnerabilidad de discrepancia de respuesta observable. El endpoint 'Login' de la aplicación devuelve respuestas JSON distintas dependiendo de si el nombre de usuario proporcionado está asociado con una cuenta existente. Debido a que las respuestas difieren en el valor de cadena 'error.message', un atacante remoto no autenticado puede enumerar nombres de usuario/cuentas válidos en el servidor. NOTA: D-Link afirma que una solución está en desarrollo.

Information

Published : 2025-10-16 19:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-34254

Mitre link : CVE-2025-34254

CVE.ORG link : CVE-2025-34254

JSON object : View

Products Affected

dlink

nuclias_connect

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2025-34254", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34254", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-17T14:29:43.264857Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "D-Link", "modules": ["web interface"], "product": "Nuclias Connect", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.1.4"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-16T19:15:32.777", "references": [{"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.dlink.com/en/for-business/nuclias/nuclias-connect", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dlink-nuclias-connect-login-account-enumeration", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability.\u00a0The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the `error.message`string value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server.\u00a0NOTE: D-Link states that a fix is under development."}, {"lang": "es", "value": "Versiones de firmware de D-Link Nuclias Connect menor o igual que 1.3.1.4 contienen una vulnerabilidad de discrepancia de respuesta observable. El endpoint 'Login' de la aplicaci\u00f3n devuelve respuestas JSON distintas dependiendo de si el nombre de usuario proporcionado est\u00e1 asociado con una cuenta existente. Debido a que las respuestas difieren en el valor de cadena 'error.message', un atacante remoto no autenticado puede enumerar nombres de usuario/cuentas v\u00e1lidos en el servidor. NOTA: D-Link afirma que una soluci\u00f3n est\u00e1 en desarrollo."}], "lastModified": "2026-10-09T10:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dlink:nuclias_connect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DDE121F-E175-450D-A078-A7BF6F643415", "versionEndIncluding": "1.3.1.4"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}