{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/e15/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-112146"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["E15","M32","R15","R32"],"_cs_severities":["medium"],"_cs_tags":["hardware","router","vulnerability","remote-access"],"_cs_type":"advisory","_cs_vendors":["D-Link"],"content_html":"\u003cp\u003eA security vulnerability identified as CVE-2026-112146 affects several D-Link router models, including the E15, M32, R15, and R32. The vulnerability resides within the MQTT Broker component, which improperly manages or exposes credentials stored in the '/etc/emDaemon/passwd' file. This flaw involves the use of hard-coded credentials that can be leveraged by an attacker to gain unauthorized access to the device. The vulnerability is exploitable remotely, and because exploit code has been made publicly available, there is an increased risk of automated or manual exploitation attempts against exposed devices. Defenders should prioritize identifying these specific D-Link models on their networks and isolating them from external access if patching or mitigation is not immediately possible.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify internet-facing D-Link devices running the vulnerable MQTT Broker component.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a network connection to the target device, targeting the MQTT service port.\u003c/li\u003e\n\u003cli\u003eAttacker uses publicly available exploit code to interface with the MQTT Broker component.\u003c/li\u003e\n\u003cli\u003eAttacker targets the '/etc/emDaemon/passwd' file processing logic via the discovered vulnerability.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the device using the hard-coded credentials recovered or utilized by the exploit.\u003c/li\u003e\n\u003cli\u003eAttacker establishes an unauthorized session to perform configuration changes or exfiltrate device information.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated, remote attackers to obtain unauthorized access to D-Link E15, M32, R15, and R32 routers. Successful exploitation could lead to full device compromise, allowing attackers to manipulate network traffic, intercept data, or pivot into internal network segments, potentially affecting the integrity and confidentiality of the entire local area network connected to these devices.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReview network egress and ingress logs for unauthorized traffic targeting MQTT service ports associated with D-Link devices.\u003c/li\u003e\n\u003cli\u003eRestrict external access to the management interface and MQTT broker ports of the affected D-Link models immediately.\u003c/li\u003e\n\u003cli\u003eConsult the D-Link support portal for the latest firmware updates that resolve CVE-2026-112146 for the affected E15, M32, R15, and R32 models and apply them.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T16:08:12Z","date_published":"2026-10-19T16:08:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dlink-mqtt-hardcoded-creds/","summary":"Multiple D-Link router models contain hard-coded credentials in the MQTT Broker component, allowing for potential remote unauthorized access via public exploit code.","title":"Hard-Coded Credentials in D-Link MQTT Broker","url":"https://feed.craftedsignal.io/briefs/2026-10-dlink-mqtt-hardcoded-creds/"}],"language":"en","title":"CraftedSignal Threat Feed - E15","version":"https://jsonfeed.org/version/1.1"}