Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-125086: D-Link M60 MQTT broker uses hard‑coded login
CVE-2026-125086 · published 5 days ago
Summary
The D-Link M60 router’s built‑in MQTT messaging service is configured with a username and password that are fixed in the software. Because these credentials cannot be changed, an attacker who can reach the device over the network could log in and control the broker. Update the router to the latest firmware that removes the hard‑coded credentials or replace the device with a model that allows you to set your own passwords.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| d-link | m60 | 1.12.B01 |
Original advisory text
D-Link M60 emDaemon MQTT Broker mosquitto.conf system hard-coded credentials
A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
References
- https://vuldb.com/vuln/433197 vdb-entry technical-description
- https://vuldb.com/vuln/433197/cti signature permissions-required
- https://vuldb.com/cve/CVE-2026-125086 third-party-advisory
- https://vuldb.com/submit/1042370 third-party-advisory
- https://github.com/XueDugu/dlink-m60-easymesh-mqtt-credential-evidence exploit
- https://www.dlink.com/ product
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-798Use of Hard-coded Credentials
CWE-259Use of Hard-coded Password
Timeline
Published10 Nov 2026
Updated14 Nov 2026
First seen10 Nov 2026
Track software like this
Free during beta