D-Link M60: Hard-coded credentials in emDaemon MQTT Broker (CVE-2026-125086)
A critical vulnerability in the emDaemon MQTT Broker component of D-Link M60 routers (version 1.12.B01) allows remote attackers to bypass authentication via hard-coded credentials.
CVE search metadata
CVE search record: CVE-2026-125086. Severity: critical. CVSS: 10.0. KEV: no. Product: M60 (1.12.B01). Brief: D-Link M60: Hard-coded credentials in emDaemon MQTT Broker (CVE-2026-125086). Brief link: https://feed.craftedsignal.io/briefs/2026-11-dlink-m60-hardcoded-creds/
Triage facts
Revision 1- Applicability
- M60 (1.12.B01)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 02:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Very likely
A critical vulnerability has been identified in D-Link M60 firmware version 1.12.B01. The issue resides within the emDaemon MQTT Broker component, specifically the system function associated with the configuration file '/etc/emDaemon/mosquitto.conf'. This flaw exposes hard-coded credentials, enabling remote, unauthenticated access to the device. The vulnerability is publicly disclosed and considered exploitable.
Impact
Successful exploitation allows remote attackers to gain unauthorized access to the affected D-Link M60 router, potentially leading to full device compromise.
Recommendation
- Inventory all D-Link M60 units in the environment to identify devices running firmware version 1.12.B01.
- Implement network-level segmentation to restrict access to the MQTT broker interface to trusted administrative subnets.
- Monitor for unauthorized authentication attempts or unexpected administrative access to network edge devices.
- Check for vendor-provided firmware updates that remediate CVE-2026-125086 and apply immediately upon release.
Immediate actions
Identify and isolate all vulnerable D-Link M60 devices running version 1.12.B01
Threat Hunt
Monitor for successful connections or administrative access to the MQTT broker port on D-Link devices
Data: Network firewall/IDS logs for MQTT traffic (typically TCP 1883/8883)
Mitigations
Apply firmware patch or restrict remote access to the broker
CVE-2026-125086