CVE-2025-34248: D-Link Nuclias Connect < v1.3.1.4 Directory Traversal to Arbitrary File Deletion
D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
D-Link Nuclias Connectto a version that resolves this vulnerability.Fixed in 1.3.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34248?
CVE-2025-34248 is a high-severity vulnerability that allows authenticated attackers to delete arbitrary files.
How do I fix CVE-2025-34248?
To fix CVE-2025-34248, upgrade D-Link Nuclias Connect firmware to version 1.3.1.4 or later.
What systems are affected by CVE-2025-34248?
CVE-2025-34248 affects D-Link Nuclias Connect firmware versions earlier than 1.3.1.4.
What can an attacker do with CVE-2025-34248?
An attacker exploiting CVE-2025-34248 can delete arbitrary files, potentially compromising system integrity.
Is authentication required to exploit CVE-2025-34248?
Yes, exploitation of CVE-2025-34248 requires authentication to the D-Link Nuclias Connect system.