D-Link M60 CVE-2026-125086

The concrete prerequisite is network reachability to the emDaemon MQTT (mosquitto) broker service on a D-Link M60 running firmware 1.12.B01; because the credentials are hard-coded in /etc/emDaemon/mosquitto.conf they are identical across affected devices and require no legitimate account, so no special feature toggle or non-default configuration is needed. The primary LIMITING factor is the attacker's network position: the CVSS vector rates it AV:N, but on a consumer mesh router the MQTT broker is typically exposed on the LAN/mesh side, so Internet-facing exploitation depends on whether the broker port is reachable from the attacker - defenders should confirm whether the broker is bound to WAN or only to local/mesh interfaces. No user interaction and no prior authentication are required once the broker is reachable.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case, though several decision signals are missing. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable flaw requiring no privileges, no user interaction and low complexity, which aligns with the mechanism: CWE-798 hard-coded credentials embedded in /etc/emDaemon/mosquitto.conf of the emDaemon MQTT broker - anyone who knows the static credentials can authenticate, so PR:N is appropriate. The vendor-assigned score of 9.3 reflects full impact to both the vulnerable system and subsequent systems. Supporting signals are partial: VulDB assigns an 'act_now' priority and a public exploit reference exists (a GitHub 'credential-evidence' repo), but it is not verified as working exploit code, and there is NO CISA KEV listing and NO EPSS score provided, so widespread or confirmed active exploitation cannot be asserted. The main conflict/uncertainty is real-world reachability versus the AV:N rating: hard-coded credentials are inherently trivial to abuse once known, but exploitation depends on the MQTT broker being reachable from the attacker's network position, which on a consumer mesh router is often LAN-side rather than Internet-exposed by default - verify exposure for your deployment. Net: credible, act-now-class credential exposure with a public PoC reference, tempered by the fact that the PoC is unverified and no KEV/EPSS data corroborates active mass exploitation.

An attacker with a network path to a D-Link M60 (1.12.B01) connects to the emDaemon MQTT broker and authenticates using the hard-coded credentials baked into /etc/emDaemon/mosquitto.conf, gaining the ability to subscribe to and publish on broker topics. From there they can read device/mesh telemetry and issue control messages to manipulate the router and its EasyMesh nodes. A public PoC reference exists (a GitHub 'credential-evidence' repository); it is not verified as working exploit code, but the low-complexity, no-interaction nature of static credentials makes reproduction straightforward.