BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-30

Assigner: VulnCheck

Description

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the `error.message`string value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server. NOTE: D-Link states that a fix is under development.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-34254

Affected Vendors & Products

Vendor	Product	Version / Range
dlink	nuclias_connect	to 1.3.1.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability exists in D-Link Nuclias Connect firmware versions up to 1.3.1.4, where the 'Login' endpoint returns different JSON error messages depending on whether the username exists. This difference allows an unauthenticated remote attacker to determine which usernames are valid on the server by observing the response discrepancy.

Impact Analysis

The vulnerability allows an unauthenticated attacker to enumerate valid usernames/accounts on the server. This can lead to targeted attacks such as brute force password attempts or social engineering, increasing the risk of unauthorized access.

Hi! I’m here to help you understand CVE-2025-34254. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70