External risk intelligence

D-Link M60 MQTT Broker Hard-Coded Credentials Remote Disclosure

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-125086

The vulnerability affects an MQTT broker component within a D-Link M60 router. As network-connected consumer premises equipment, routers frequently expose management and communication services to the local network and, depending on configuration and UPnP/NAT settings, may be reachable from the internet, making their service endpoints commonly encountered in externally reachable deployment contexts.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been publicly disclosed in the emDaemon MQTT Broker, a component found in D-Link M60 devices. This issue, if exploited, could allow for remote access through hard-coded credentials, potentially impacting the security and integrity of connected systems. The main concern at this time is confirming if this technology is in use and assessing potential exposure.

Hard-coded credentials could allow unauthorized remote access.
Leadership should remember this affects network-connected devices.
Confirm relevance and potential exposure to this technology.

Attack Path

How an attacker could exploit the issue

An attacker can remotely exploit this vulnerability by targeting the emDaemon MQTT Broker. Successful exploitation allows an attacker to manipulate the system's hard-coded credentials, potentially leading to a critical compromise.

No authentication required.
Manipulate the mosquitto.conf file.
Leads to hard-coded credentials.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could expose hard-coded credentials within the emDaemon MQTT Broker, potentially allowing unauthorized access to system data and service control when the system is accessible remotely.

System data and service control at risk.
Remote manipulation of configuration.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in the D-Link M60's emDaemon MQTT Broker impacts system configuration, potentially exposing hard-coded credentials that are remotely exploitable. This critical issue likely falls under the purview of infrastructure or platform teams responsible for network-attached devices and their core services. The immediate first step is to identify all D-Link M60 devices within the environment, confirm their network accessibility, and assess their business criticality to prioritize remediation efforts.

Infrastructure teams own the fix.
Verify device network exposure.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link M60 and the emDaemon MQTT Broker?

The D-Link M60 is a home networking device designed for wireless connectivity and mesh networking. Within its firmware, it utilizes a component called emDaemon, which includes an MQTT broker. MQTT is a messaging protocol often used by internet-connected devices to exchange data and manage communications between different system services.

What does CWE-259 and CWE-798 mean for CVE-2026-125086?

These codes identify the vulnerability as the use of hard-coded credentials. In plain English, this means the device's software contains secret access information—such as a password or key—that is fixed during development and cannot be changed by the user. Because this sensitive data is embedded directly into the broker's configuration, an attacker can use it to gain unauthorized control.

How can an attacker trigger this vulnerability?

An attacker can exploit this remotely by interacting with the emDaemon MQTT Broker service. Because the credentials are hard-coded into the mosquitto.conf configuration file, the system does not require any additional authentication to be bypassed. Please note that simply connecting to the device's standard Wi-Fi network does not necessarily mean the broker is targeted; the attack focuses specifically on interacting with the MQTT service's entry point.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal notes that since the D-Link M60 is network-connected consumer equipment, its services are often reachable on the local network. Crucially, depending on specific settings like UPnP or NAT, these service endpoints can sometimes be reached directly from the internet. If your device is configured to allow remote management, it falls into the category of externally reachable deployments.

What steps should I take if I use a D-Link M60?

Your first priority is to locate all D-Link M60 devices currently deployed in your network environment. Once identified, evaluate whether these devices are accessible from the public internet versus restricted to an internal network. Assess the importance of the data handled by these routers and coordinate with your infrastructure team to monitor for vendor-provided updates or guidance regarding device configuration.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.