CVE-2026-112146
Deferred Deferred - Pending Action

Hard-Coded Credentials in D-Link E15 M32 R15 R32 MQTT Broker

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112146
EUVD
EUVD-2026-104276

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
D-Link E15 n/a
D-Link M32 n/a
D-Link R15 n/a
D-Link R32 n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a hard-coded credential issue in D-Link E15, M32, R15, and R32 devices. The MQTT broker uses default username and password 'admin/admin' that cannot be changed. These credentials are hard-coded in the firmware and allow remote attackers on the same network to connect to the MQTT broker and manipulate control topics.

Detection Guidance

Check if the MQTT broker configuration file exists at /etc/emDaemon/passwd or /etc/emDaemon/mosquitto.conf. Use commands like 'cat /etc/emDaemon/passwd' or 'grep admin /etc/emDaemon/mosquitto.conf' to verify if default credentials 'admin/admin' are present.

Impact Analysis

An attacker on the same network or bridged EasyMesh backhaul could exploit this to gain unauthorized access to the MQTT broker. This may allow them to manipulate device communications, intercept data, or execute unauthorized commands on affected D-Link devices.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and secure authentication. It could lead to unauthorized access to sensitive data, violating GDPR's integrity and confidentiality principles and HIPAA's safeguards for protected health information.

Mitigation Strategies

Update firmware to the latest version if available. Change default credentials if possible. Restrict network access to the MQTT broker by configuring firewall rules to allow only trusted devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart