CVE-2025-34253 is a stored XSS vulnerability in D-Link Nuclias Connect firmware versions <= 1.3.1.4. The flaw arises from improper neutralization of input in the 'Network' field when users edit configurations, create profiles, or add networks. Authenticated attackers can exploit this to inject arbitrary JavaScript, which executes in other users' browsers when they view the compromised profile entries. This vulnerability is classified under CWE-79. Currently, no official patch is available, but the vendor has confirmed that a fix is being developed.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who view the affected profile entries. This can lead to session hijacking, unauthorized actions, or other client-side impacts typical of stored XSS vulnerabilities. There is no indication of privilege escalation or direct system compromise from the provided data.

D-Link has stated that a fix is under development; therefore, no official patch is currently available. Users should monitor the vendor's advisories for the release of the official fix. Until then, restricting access to the configuration interface to trusted users and minimizing the number of users with profile editing permissions can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.