D-Link EAGLE PRO EUVD-2026-104276

Exploitation requires network reachability to the MQTT Broker service on an affected D-Link EAGLE PRO AI device (E15, M32, R15, R32) and knowledge of the credentials hard-coded in /etc/emDaemon/passwd, which are now public via the GitHub PoC. The practical limiting factor is network exposure of the MQTT broker: on typical consumer deployments this service is bound to the LAN/mesh backhaul rather than the WAN, so remote (internet-side) exploitation likely requires the attacker to already be on the local or mesh network unless the broker port is exposed. Impact is inherently limited (all CVSS impact sub-metrics are Low), confining the attacker to the MQTT message bus rather than full device takeover. Affected firmware versions are not specified in the available data.

This is a low-urgency issue despite being remotely reachable, and the signals are largely consistent on that point. The vendor/CNA (VulDB) CVSS 4.0 score is only 2.1, with a vector of AV:N/AC:L/PR:L/UI:N and uniformly Low impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) - meaning even successful exploitation yields limited gain. There is no EPSS score provided and the CVE is NOT in the CISA KEV catalog, so there is no evidence of active or widespread exploitation. The one elevating signal is that public exploit code exists (GitHub PoC, consistent with the CVSS 4.0 'E:P' Exploit Maturity = Proof-of-Concept), but PoC availability is not the same as in-the-wild exploitation. A notable tension: CWE-259 (hard-coded credentials) and the 'Authentication Bypass' tag imply that no legitimate account is required, yet the supplied CVSS vector sets PR:L (privileges required = Low) - these conflict, and the true attacker prerequisite (whether the hard-coded MQTT credentials can be used with zero prior access) should be verified against the PoC and vendor advisory. Net: a real but low-priority defect, driven more by the embarrassment/architectural-weakness of hard-coded credentials than by imminent mass-exploitation risk.

An attacker with network reachability to an affected D-Link mesh device (E15/M32/R15/R32) connects to the MQTT Broker component and authenticates using the hard-coded credentials embedded in /etc/emDaemon/passwd, which are identical across all units of these models. A public proof-of-concept demonstrating the credential extraction exists on GitHub. Given the Low impact metrics, the attacker gains limited read/write interaction with the MQTT message bus rather than full device compromise.