Dashboard / CVE-2025-34253

CVE-2025-34253

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 50/100
Published: 2025-10-16 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Passive
AT: None
VC: None
VI: None
VA: None

Description

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link fixed this issue in version 1.3.1.5.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
D-Link Nuclias Connect 0 < 1.3.1.5
D-Link Nuclias Connect 0 < 1.3.1.5
dlink nuclias_connect < 1.3.1.4

References & Advisories (3)

Bug Bounty Relevance

50 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.54%
Raw Score 0.005370
Percentile 45.2%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links