CVE-2025-34248 is a CWE-22 path traversal vulnerability in D-Link Nuclias Connect firmware versions before 1.3.1.4. It arises from improper sanitization of the deleteBackupList parameter in the /api/web/dnc/global/database/deleteBackup API endpoint. This allows an authenticated attacker to delete arbitrary files on the system, impacting its integrity and availability. The vulnerability has a CVSS 4.0 score of 7.2 (high severity) with network attack vector, low attack complexity, and no user interaction required. No patch or official remediation information is currently available.

Successful exploitation allows an authenticated attacker to delete arbitrary files on the affected system, which can compromise system integrity and availability. This could disrupt normal operations or cause denial of service conditions. There is no indication of confidentiality impact or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the product is not a cloud service, remediation depends on vendor-provided firmware updates. Until a patch is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious activity involving file deletion requests.