CVE-2025-34253: D-Link Nuclias Connect <= v1.3.1.4 Stored Cross-Site Scripting (XSS)
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link states that a fix is under development.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34253?
CVE-2025-34253 is considered a high severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2025-34253?
To mitigate CVE-2025-34253, upgrade D-Link Nuclias Connect firmware to a version beyond 1.3.1.4 where the vulnerability is patched.
What type of vulnerability is CVE-2025-34253?
CVE-2025-34253 is a stored cross-site scripting (XSS) vulnerability affecting the Network field in D-Link Nuclias Connect.
Who is affected by CVE-2025-34253?
CVE-2025-34253 affects users of D-Link Nuclias Connect firmware versions 1.3.1.4 and below.
Can an unauthenticated user exploit CVE-2025-34253?
No, CVE-2025-34253 can only be exploited by an authenticated user with access to the configuration settings.