In version 1.12.B01 of D-Link’s AX6000-class wireless mesh router M60, a hardcoded username and password are embedded in the MQTT broker running on the device. The issue, tracked as CVE-2026-125086, has a CVSS 4.0 base score of 9.3 in the NVD, which puts it at critical severity. The researcher has also made exploit code publicly available.
Where exactly is the flaw
On every boot, the control service called /usr/bin/commander rewrites the MQTT broker’s configuration file and password file from fixed values inside the binary. In the resulting configuration, the broker listens on port 1883, does not allow anonymous connections, and the password file contains a single account: admin / admin.
The broker binds not just to the local address, but to all network interfaces (0.0.0.0 and [::] on the IPv6 side). That means anyone who can reach port 1883 on the device can connect using these hardcoded credentials. The researcher demonstrated this in the validation notes with three separate MQTT connection attempts: the connection is accepted with the correct password, while the wrong password and anonymous access are both rejected.
There are services behind it running with root privileges
The EasyMeshDaemon, emhandler, and ACSDaemon processes that use the MQTT broker all run as root on the device. ACSDaemon executes the /tmp/acs.sh file via a system call; emhandler handles file-copy operations for member management; and member firmware download headers also trigger the update flow.
Because of this, an attacker who connects to the broker can do more than just monitor traffic; they can spoof control commands such as channel switching, mesh member operations, and firmware downloads, and reach the root-privileged command paths behind them.
Who is at risk
The NVD entry says the issue can be exploited over the network and without authentication. In practice, the attacker needs to be in a neighboring position to the device: a device on the same local network or a node bridged to the EasyMesh backhaul line is enough. Internet access is only possible if port 1883 has been forwarded externally.
The annoying detail here is this: changing the router’s admin password does not fix the issue. Because the commander service recreates the password file on every boot, the hardcoded credentials remain in place.
What to do
The NVD entry does not mention a patched version, and the researcher notes that the issue was reported to D-Link’s security team and that no CVE had been assigned when the package was prepared. There’s only so much users can do, but it’s not nothing:
If you use an M60, check the D-Link support page for the latest firmware matching your model and hardware revision, and install it if available. Do not expose port 1883 to the internet in the router’s management interface, and review your port forwarding rules. Keep untrusted devices on your home network—smart TVs, cameras, guest phones—separate from the main network; the guest network feature makes it harder for those devices to reach the router’s internal services. It’s also worth checking whether an unauthorized node has been added to your mesh system.
If you use the M60 for critical work or home automation, the safest temporary option is to keep the device on a separate network segment until the vendor releases a fix.
Source: NVD · the researcher’s write-up
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.