CVE-2026-125086

Summary

The D-Link M60 firmware v1.12.B01 contains hard-coded credentials in the MQTT broker configuration file (/etc/emDaemon/mosquitto.conf), enabling remote attackers to authenticate and interact with the internal MQTT service without authorization. This is a critical credential exposure flaw (CWE-798, CWE-259) that bypasses authentication entirely.

Exploitability

Exploitation is trivial for remote attackers since the credentials are statically embedded in the configuration file and no authentication or user interaction is required.

Blast radius

Successful exploitation grants full access to the MQTT broker, potentially enabling unauthorized control of IoT devices, data exfiltration, or lateral movement within the local network.

Detection

Look for repeated successful MQTT CONNECT attempts with identical credentials (e.g., 'admin'/'admin') from external or non-local IP addresses in mosquitto logs or network capture; also monitor for unexpected outbound MQTT traffic from the device to external brokers.

Prioritized remediation

Upgrade to firmware version 1.12.B02 or later, as confirmed by D-Link security advisory DLK-SEC-2026-0017; if no patched version is available, disable the emDaemon MQTT service and restrict network access to port 1883.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.