CVE-2025-34255
📋 TL;DR
This vulnerability allows unauthenticated attackers to enumerate valid email addresses on D-Link Nuclias Connect systems by exploiting response differences in the 'Forgot Password' endpoint. Organizations using affected firmware versions are at risk of having their user accounts discovered, which could facilitate targeted attacks. The vulnerability affects all default configurations of the specified firmware versions.
💻 Affected Systems
- D-Link Nuclias Connect
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers build comprehensive user directories, enabling highly targeted phishing campaigns, credential stuffing attacks, or social engineering against specific individuals within the organization.
Likely Case
Attackers enumerate valid email addresses to identify potential targets for credential spraying or targeted phishing, increasing the likelihood of successful account compromise.
If Mitigated
With proper network segmentation and monitoring, the impact is limited to information disclosure without direct system compromise, though user privacy is still violated.
🎯 Exploit Status
Exploitation requires only HTTP requests to the vulnerable endpoint with different email addresses; no authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not yet released
Vendor Advisory: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
Restart Required: No
Instructions:
Monitor D-Link security advisories for patch release; apply firmware update when available through Nuclias Connect management interface.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to the Nuclias Connect management interface to trusted internal networks only
Web Application Firewall
allImplement WAF rules to block or normalize responses from the /api/forgot-password endpoint
🧯 If You Can't Patch
- Implement rate limiting on the vulnerable endpoint to slow enumeration attempts
- Monitor for unusual patterns of requests to the forgot password endpoint
🔍 How to Verify
Check if Vulnerable:
Send POST requests to /api/forgot-password with different email addresses; compare responses for differences in 'data.exist' fieldCheck Version:
Check firmware version in Nuclias Connect web interface under System > AboutVerify Fix Applied:
After patching, verify that responses from the forgot password endpoint are identical regardless of whether email exists📡 Detection & Monitoring
Log Indicators:
- Multiple failed forgot password attempts from single IP
- Unusual volume of requests to /api/forgot-password
Network Indicators:
- HTTP POST requests to /api/forgot-password with varying email parameters
- Pattern of sequential requests with different email addresses
SIEM Query:
source="nuclias_logs" AND uri_path="/api/forgot-password" AND count by src_ip > 10 within 5m