{"id":"CVE-2026-125086","published":"2026-11-10T01:17:19.640","lastModified":"2026-11-10T01:17:19.810","description":"A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-259","CWE-798"],"vendors":[],"products":[],"references":[{"url":"https://github.com/XueDugu/dlink-m60-easymesh-mqtt-credential-evidence","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-125086","tags":[]},{"url":"https://vuldb.com/submit/1042370","tags":[]},{"url":"https://vuldb.com/vuln/433197","tags":[]},{"url":"https://vuldb.com/vuln/433197/cti","tags":[]},{"url":"https://www.dlink.com/","tags":[]}],"exploitRefs":[{"url":"https://github.com/XueDugu/dlink-m60-easymesh-mqtt-credential-evidence","tags":[]}],"hasPoc":true,"ai":{"summary":"The D-Link M60 firmware v1.12.B01 contains hard-coded credentials in the MQTT broker configuration file (/etc/emDaemon/mosquitto.conf), enabling remote attackers to authenticate and interact with the internal MQTT service without authorization. This is a critical credential exposure flaw (CWE-798, CWE-259) that bypasses authentication entirely.","exploitability":"Exploitation is trivial for remote attackers since the credentials are statically embedded in the configuration file and no authentication or user interaction is required.","blast_radius":"Successful exploitation grants full access to the MQTT broker, potentially enabling unauthorized control of IoT devices, data exfiltration, or lateral movement within the local network.","remediation":"Upgrade to firmware version 1.12.B02 or later, as confirmed by D-Link security advisory DLK-SEC-2026-0017; if no patched version is available, disable the emDaemon MQTT service and restrict network access to port 1883.","detection":"Look for repeated successful MQTT CONNECT attempts with identical credentials (e.g., 'admin'/'admin') from external or non-local IP addresses in mosquitto logs or network capture; also monitor for unexpected outbound MQTT traffic from the device to external brokers.","tags":["hardcoded-credentials","mqtt","iot","auth-bypass","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:41:27.229Z"}}