CVE-2025-34248: D-Link Nuclias Connect < v1.3.1.4 Directory Traversal to Arbitrary File Deletion

Severity: high (CVSS 7.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-09 · updated 2026-10-23
Weakness: CWE-22

Description

D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.

Affected products

D-Link Nuclias Connect: before 1.3.1.4 — fixed in 1.3.1.4

How to fix

Upgrade to a fixed version: D-Link Nuclias Connect 1.3.1.4. Check the vendor advisory for mitigations.

References

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
https://www.dlink.com/en/for-business/nuclias/nuclias-connect
https://www.vulncheck.com/advisories/dlink-nuclias-connect-directory-traversal-to-arbitrary-file-deletion

Get alerted when CVE-2025-34248 or the next vulnerability affects your stack