CVE-2025-34255

Katalog CVE

CVSS 5.3 · Medium EPSS 1,0%

Kerentanan Observable Response Discrepancy pada dlink nuclias connect. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

Rincian

Terbit di NVD

16 Oktober 2025

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472 advisory vendor
• https://www.vulncheck.com/advisories/dlink-nuclias-connect-forgot-password-account-enumeration advisory pihak ketiga
• https://www.dlink.com/en/for-business/nuclias/nuclias-connect product