CVE-2025-34255
⚪ Do wiadomości
Luka w D-Link Nuclias Connect pozwala na enumerację adresów e-mail bez uwierzytelnienia.
CVSS
5.3
EPSS
1.0%
Exploit
none
Vendor
dlink
Opis źródłowy (NVD)
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 5.3 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 1.0% |
| Opublikowano (NVD) | 2025-10-16 19:15:32 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-30 23:10:00 UTC |
Referencje
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472 ([email protected]) [Vendor Advisory]
- https://www.dlink.com/en/for-business/nuclias/nuclias-connect ([email protected]) [Product]
- https://www.vulncheck.com/advisories/dlink-nuclias-connect-forgot-password-account-enumeration ([email protected]) [Third Party Advisory]