CVE-2026-125086 is a critical hard-coded credentials flaw in the emDaemon MQTT Broker component of D-Link M60 firmware 1.12.B01. It can be exploited remotely, and a public exploit has been disclosed.
What Is It
The vulnerability sits in the emDaemon MQTT Broker component of the D-Link M60. The NVD record names the system function and the file /etc/emDaemon/mosquitto.conf, and says that manipulating it "leads to hard-coded credentials." The weakness is classified as CWE-259 (Use of Hard-coded Password) and CWE-798 (Use of Hard-coded Credentials).
VulDB, the CNA, assigned the CVE. As of this writing, NVD lists the record's status as "Deferred."
Why It Matters
The CNA scored this flaw at the top of the severity range:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated as Proof-of-Concept
- CVSS 2.0: 10.0
The vector shows the attack works over the network and is easy to carry out. The attacker needs no account and no help from a user. Confidentiality, integrity and availability impacts are all rated high. The CVSS 3.1 scope is "Changed," which means the damage can spread beyond the vulnerable component. The CVE description says the exploit "has been disclosed to the public and may be used," and the references include a public GitHub evidence repository.
The supplied data has no CISA KEV entry for this CVE, so KEV does not currently confirm that attackers are using it in the wild. Because the exploit is public, anyone can try it, but that alone does not prove attacks have been seen.
What's Vulnerable
- Vendor: D-Link
- Product: M60
- Component: emDaemon MQTT Broker
- Affected version: 1.12.B01
- CPE:
cpe:2.3:h:d-link:m60:*:*:*:*:*:*:*:*
The supplied records list no other affected versions.
Patch Status
The supplied NVD and VulDB data give no patch, fixed firmware version or vendor advisory. The only vendor reference is D-Link's general homepage. With no KEV entry, there is also no CISA required action or remediation due date.
Owners of D-Link M60 devices running 1.12.B01 should check D-Link directly for firmware updates or guidance. Until a fix is confirmed, they should assume that anyone who can reach the device's MQTT broker over the network may be able to log in with the built-in credentials. They should block access to the broker from any network they don't trust.