关键信息 漏洞名称: D-Link Nuclias Connect <= v1.3.1.4 Stored Cross-Site Scripting (XSS) 严重性: MEDIUM 日期: October 16, 2025 影响版本: Nuclias Connect <= 1.3.1.4 CVE编号: CVE-2025-34253 CWE编号: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') CVSS评分: 5.1 CVSS V4向量: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N 参考资料: - D-Link Advisory - D-Link Nuclias Connect 发现者: Alex Williams from Pelleria Technologies 描述: - D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link states that a fix is under development.