CVE-2025-34254: D-Link Nuclias Connect <= v1.3.1.4 Login Account Enumeration
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the error.messagestring value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server. NOTE: D-Link states that a fix is under development.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34254?
CVE-2025-34254 is considered a medium severity vulnerability due to its potential for account enumeration.
How do I fix CVE-2025-34254?
To fix CVE-2025-34254, upgrade your D-Link Nuclias Connect firmware to a version later than 1.3.1.4.
What does CVE-2025-34254 affect?
CVE-2025-34254 affects D-Link Nuclias Connect firmware versions 1.3.1.4 and below.
How does CVE-2025-34254 impact security?
CVE-2025-34254 allows attackers to determine valid usernames via different JSON responses at the login endpoint.
Is CVE-2025-34254 easy to exploit?
Yes, CVE-2025-34254 can be exploited with minimal technical skills since it involves observing response discrepancies.