Vulnerability · Published Oct 16, 2025 · Assigned by VulnCheck

CVE-2025-34253D-Link Nuclias Connect <= v1.3.1.4 Stored Cross-Site Scripting (XSS)

Medium 5.1

In plain English

A medium-severity cross-site scripting in Nuclias Connect from D-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.5%top 53.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link fixed this issue in version 1.3.1.5.

Affected products (as reported)

Vendor	Product	Versions
D-Link	Nuclias Connect	0 – before 1.3.1.5

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://www.vulncheck.com/advisories/dlink-nuclias-connect-stored-xss third-party-advisory
https://www.dlink.com/en/for-business/nuclias/nuclias-connect product
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472 vendor-advisory