CVE-2026-125086

CriticalCVSS 10.0

Published: 10/11/2026(UTC)Updated: 10/11/2026(UTC)Translated: 10/11/2026(UTC)NVD NIST

Summary

D-Link M60 1.12.B01 contains hard-coded credentials in the /etc/emDaemon/mosquitto.conf file of the emDaemon MQTT Broker component. The vulnerability can be exploited remotely, and a public exploit may already be in use.

Risk Assessment

Hard-coded credentials allow a remote attacker unauthorized access to the MQTT broker, potentially leading to device and IoT traffic compromise.

Recommendation

Change default MQTT credentials, restrict network access to the broker, and apply firmware updates if provided by the vendor.

Other vulnerabilities in D-Link M60

CVE-2026-7554Medium
D-Link M60 up to 1.20B02 is affected by a weak password recovery issue in /usr/bin/httpd. The attack can be initiated remotely but requires high complexity and is known to be difficult to exploit. The exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS