Answer in brief
CVE-2025-34253 records a Medium severity (CVSS 5.1) vulnerability in D-Link Nuclias Connect <= v1.3.1.4 Stored Cross-Site Scripting (XSS). The current sources do not mark it as known exploited. The current feed maps D-Link/Nuclias Connect (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps D-Link/Nuclias Connect (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:dlink:nuclias_connect:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| D-Link/Nuclias Connectgeneric | >=0 <1.3.1.5 | 1.3.1.5 |
Published upstream
Oct 16, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link fixed this issue in version 1.3.1.5.
Quoted source text, attributed separately from HOL analysis.