{"id":"CVE-2026-125086","kind":"vulnerability","aliases":["CVE-2026-125086"],"related":[],"title":"D-Link M60: hard-coded credentials in MQTT broker allow remote access","description":"A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.","summary":"The emDaemon MQTT Broker on the D-Link M60 firmware 1.12.B01 stores hard-coded credentials in its mosquitto.conf file. A remote attacker can use these built-in credentials to access the broker without a password.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"M60","fixed":[],"affected":"1.12.B01","ecosystem":"vendor"}],"ecosystems":[],"tags":["d-link","infrastructure","iot","m60","mqtt"],"not_affected_if":["broker-not-reachable","other-firmware"],"how_to_check":"- Confirm the device is a D-Link M60 running firmware 1.12.B01 (router admin page > firmware version). NVD lists only this version; other M60 versions are not confirmed either way.\n- Check whether the emDaemon MQTT broker is reachable from your network (default MQTT port is 1883; not confirmed for the M60): from a LAN host run a port scan of the router for 1883.\n- Also check if you run D-Link E15, M32, R15 or R32: a sibling issue (CVE-2026-112146) in the same emDaemon broker reports a fixed admin:admin account written to /etc/emDaemon/passwd (VulDB submission, not a D-Link page). That is a different CVE and not confirmed for the M60.\n- Check D-Link's support announcements (supportannouncement.us.dlink.com) for an M60 entry; none was found on 2026-11-10.","fix":null,"status":"open","published_at":"2026-11-10T01:17:19+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:07+00:00","updated_at":"2026-11-10T01:30:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T01:28:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"D-Link M60: hard-coded credentials in MQTT broker allow remote access","impact":"high","summary":"The emDaemon MQTT Broker on the D-Link M60 firmware 1.12.B01 stores hard-coded credentials in its mosquitto.conf file. A remote attacker can use these built-in credentials to access the broker without a password.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["d-link","m60","mqtt","iot"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker logs into broker using built-in credentials","analyst_note":"Confirm whether a vendor fix exists and whether the broker is enabled by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125086.","how_to_check":"- Confirm the device model and firmware version: M60 running `1.12.B01`.\n- Check whether the emDaemon MQTT broker is reachable from the network.\n- Review `/etc/emDaemon/mosquitto.conf` on the device for embedded credentials, if you have access.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware","broker-not-reachable"],"who_is_affected":"Teams running D-Link M60 devices with firmware 1.12.B01 where the emDaemon MQTT broker is reachable over the network. The sources do not say whether the broker is enabled by default. Devices not running this firmware or without a reachable MQTT broker are likely not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00076,"input_tokens":4555,"output_tokens":609,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a vendor fix exists and whether the broker is enabled by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125086.","search":"'-125086':17A,20A '-2026':16A,19A '/etc/emdaemon/mosquitto.conf':88C '1.12':40B,78C 'access':14A,62B 'allow':12A 'attack':53B,104C 'b01':41B,79C 'broker':11A,32B,64B,94C 'built':58B 'built-in':57B 'code':7A,45B,101C 'compon':91C 'credenti':8A,46B,60B,102C 'cve':15A,18A 'd':2A,23B,36B,75C 'd-link':1A,22B,35B,74C 'disclos':113C 'emdaemon':30B,92C 'execut':107C 'exploit':110C 'file':50B,87C 'firmwar':39B 'found':72C 'function':83C 'hard':6A,44B,100C 'hard-cod':5A,43B,99C 'impact':80C 'infrastructur':25B 'iot':26B 'lead':97C 'link':3A,24B,37B,76C 'm60':4A,21A,27B,38B,77C 'manipul':96C 'may':118C 'mosquitto.conf':49B 'mqtt':10A,28B,31B,93C 'password':67B 'public':116C 'remot':13A,52B,108C 'store':42B 'system':84C 'use':55B,120C 'vulner':69C 'without':65B","nicknames":[],"mitigations":[],"who_affected":"Teams running D-Link M60 devices with firmware 1.12.B01 where the emDaemon MQTT broker is reachable over the network. The sources do not say whether the broker is enabled by default. Devices not running this firmware or without a reachable MQTT broker are likely not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":["m60"],"ptokens":["m60"],"labels":["critical","dlink","infrastructure","iot","m60","mqtt"],"campaign_type":null,"search_a":"'-125086':17A,20A '-2026':16A,19A 'access':14A 'allow':12A 'broker':11A 'code':7A 'credenti':8A 'cve':15A,18A 'd':2A 'd-link':1A 'hard':6A 'hard-cod':5A 'link':3A 'm60':4A,21A 'mqtt':10A 'remot':13A","search_b":"'1.12':40B 'access':62B 'attack':53B 'b01':41B 'broker':32B,64B 'built':58B 'built-in':57B 'code':45B 'credenti':46B,60B 'd':23B,36B 'd-link':22B,35B 'emdaemon':30B 'file':50B 'firmwar':39B 'hard':44B 'hard-cod':43B 'infrastructur':25B 'iot':26B 'link':24B,37B 'm60':27B,38B 'mosquitto.conf':49B 'mqtt':28B,31B 'password':67B 'remot':52B 'store':42B 'use':55B 'without':65B","search_c":"'/etc/emdaemon/mosquitto.conf':88C '1.12':78C 'attack':104C 'b01':79C 'broker':94C 'code':101C 'compon':91C 'credenti':102C 'd':75C 'd-link':74C 'disclos':113C 'emdaemon':92C 'execut':107C 'exploit':110C 'file':87C 'found':72C 'function':83C 'hard':100C 'hard-cod':99C 'impact':80C 'lead':97C 'link':76C 'm60':77C 'manipul':96C 'may':118C 'mqtt':93C 'public':116C 'remot':108C 'system':84C 'use':120C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125086","severity":null,"published_at":"2026-11-10T01:17:19+00:00","modified_at":"2026-11-10T01:17:19+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125086:2373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125086","severity":null,"published_at":"2026-11-10T01:30:34+00:00","modified_at":"2026-11-10T01:30:34+00:00","first_seen_at":"2026-11-10T01:30:34+00:00","fetched_at":"2026-11-10T01:30:34+00:00","note":"Only NVD/VulDB-derived description found (public exploit mentioned, no PoC link located). No D-Link advisory or fixed firmware for M60 found on the support announcements page; fix unknown. Not stated whether broker is enabled by default. web-cli search worked; X not checked. Verified nothing: no vendor primary source. Sibling CVE-2026-112146 (E15/M32/R15/R32) linked as context only. Not setting plain_action: no vendor action exists yet.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-125086","https://vuldb.com/submit/1013245"]}],"documents":[{"id":112439,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125086","title":"NVD: CVE-2026-125086","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112440,"url":"https://vuldb.com/submit/1013245","title":"VulDB submit 1013245: sibling emDaemon MQTT hard-coded credentials (R15/E15/R32/M32)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}