CVE-2025-34253
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link states that a fix is under development.
- Score
- CVSS 3.1 5.4 Medium
- Status
- Analyzed - disclosure@vulncheck.com
- Published
- 2025-10-16
- Last modified
- 2026-10-09
- Weaknesses
- CWE-79
Affected products
References
- https://www.vulncheck.com/advisories/dlink-nuclias-connect-stored-xss
- https://www.dlink.com/en/for-business/nuclias/nuclias-connect
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
