CVE-2026-112146

7.4High

Published 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.4High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-259, CWE-798

Impact

Remote attackers with low-privilege network access can authenticate to the device's MQTT Broker and compromise integrity and availability across connected mesh nodes. A public exploit is available.

Root cause

The MQTT broker daemon uses hard-coded credentials stored in /etc/emDaemon/passwd.

Affected systems

D-Link E15, M32, R15, and R32 (exact versions not listed — check the vendor advisory).

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Fix & remediation

No fixed firmware version is stated in the advisory; isolate affected devices to a dedicated management VLAN and block inbound network access to the MQTT broker port.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112146