Executive Summary

This vulnerability exists in D-Link Nuclias Connect firmware versions up to 1.3.1.4. The 'Forgot Password' endpoint returns different JSON responses depending on whether the provided email address is associated with an existing account. Specifically, the 'data.exist' boolean value differs, allowing an unauthenticated remote attacker to determine which email addresses/accounts are valid on the server.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an unauthenticated attacker to enumerate valid email addresses or accounts on the server. This can lead to privacy breaches, targeted phishing attacks, or further exploitation attempts against known accounts.

Useful 0 Not Useful 0