QwikSec

Security Database

CVE

CWE

Training

CVE-2025-34248

Published: Oct 9, 2025

Modified: May 15, 2026

PUBLISHED

Description

D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to delete arbitrary files impacting the integrity and availability of the system.

Vendor	Product	Versions
D-Link	Nuclias Connect	affected `0 - < 1.3.1.4`

Weaknesses (CWE)

References

https://www.vulncheck.com/advisories/dlink-nuclias-connect-directory-traversal-to-arbitrary-file-deletion

third-party-advisory

https://www.dlink.com/en/for-business/nuclias/nuclias-connect

product

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472

vendor-advisory

patch

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.