M60 · CVE-2026-125086 · Infrastructure
NO FIX YET
The emDaemon MQTT Broker on the D-Link M60 firmware 1.12.B01 stores hard-coded credentials in its mosquitto.conf file. A remote attacker can use these built-in credentials to access the broker without a password.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running D-Link M60 devices with firmware 1.12.B01 where the emDaemon MQTT broker is reachable over the network. The sources do not say whether the broker is enabled by default. Devices not running this firmware or without a reachable MQTT broker are likely not affected.
Not affected if broker-not-reachable, other-firmware
Who cares d-link, iot, m60, mqtt
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.