CVE-2026-125086: D-Link M60 emDaemon MQTT Broker mosquitto.conf system hard-coded credentials
Published Nov 10, 2026
·Updated
A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Affected Software
1 affected component
D-Link M60=1.12.B01
Event History
Nov 10, 2026
CVE Published
via MITRE·12:45 AM
Data Sourced
via MITRE·12:45 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems should be prioritized for assessment?
D-Link M60 devices running version 1.12.B01 should be prioritized, specifically where the emDaemon MQTT Broker is present.
2
What does an attacker need to exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction. Public exploit disclosure means exploit code or details may be available to attackers.