---
id: "CVE-2026-125086"
page: "https://infrastack.ai/live/CVE-2026-125086"
kind: "vulnerability"
aliases: ["CVE-2026-125086"]
title: "D-Link M60: hard-coded credentials in MQTT broker allow remote access"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "M60", "fixed": [], "affected": "1.12.B01", "ecosystem": "vendor"}]
ecosystems: []
tags: ["d-link", "infrastructure", "iot", "m60", "mqtt"]
not_affected_if: ["broker-not-reachable", "other-firmware"]
published_at: "2026-11-10T01:17:19+00:00"
first_seen_at: "2026-11-10T01:26:41+00:00"
updated_at: "2026-11-10T01:30:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125086", "first_seen_at": "2026-11-10T01:26:41+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125086", "first_seen_at": "2026-11-10T01:30:34+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-125086", "https://vuldb.com/submit/1013245"]}]
exploit_sources: []
---

# D-Link M60: hard-coded credentials in MQTT broker allow remote access

Link for people: https://infrastack.ai/live/CVE-2026-125086 (this .md is for agents)

The emDaemon MQTT Broker on the D-Link M60 firmware 1.12.B01 stores hard-coded credentials in its mosquitto.conf file. A remote attacker can use these built-in credentials to access the broker without a password.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:M60 affected 1.12.B01 fixed no fixed version listed

## How to check

- Confirm the device is a D-Link M60 running firmware 1.12.B01 (router admin page > firmware version). NVD lists only this version; other M60 versions are not confirmed either way.
- Check whether the emDaemon MQTT broker is reachable from your network (default MQTT port is 1883; not confirmed for the M60): from a LAN host run a port scan of the router for 1883.
- Also check if you run D-Link E15, M32, R15 or R32: a sibling issue (CVE-2026-112146) in the same emDaemon broker reports a fixed admin:admin account written to /etc/emDaemon/passwd (VulDB submission, not a D-Link page). That is a different CVE and not confirmed for the M60.
- Check D-Link's support announcements (supportannouncement.us.dlink.com) for an M60 entry; none was found on 2026-11-10.

## Timeline

- 2026-11-10T01:26:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125086
- 2026-11-10T01:30:34+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-125086 — Only NVD/VulDB-derived description found (public exploit mentioned, no PoC link located). No D-Link advisory or fixed firmware for M60 found on the support announcements page; fix unknown. Not stated whether broker is enabled by default. web-cli search worked; X not checked. Verified nothing: no vendor primary source. Sibling CVE-2026-112146 (E15/M32/R15/R32) linked as context only. Not setting plain_action: no vendor action exists yet.

## Documents

- [describes] NVD: CVE-2026-125086 https://nvd.nist.gov/vuln/detail/CVE-2026-125086
- [mentions] VulDB submit 1013245: sibling emDaemon MQTT hard-coded credentials (R15/E15/R32/M32) https://vuldb.com/submit/1013245

## From the sources

A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_