Description
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized MQTT broker access via hard‑coded credentials
Action: Immediate patch
AI Analysis

Impact

Affected D‑Link routers incorrectly process the /etc/emDaemon/passwd file so that the MQTT broker contains hard‑coded credentials. An attacker can exploit this to authenticate as a user without needing legitimate credentials, gaining full access to MQTT topics and control functions. This flaw maps to CWE‑259 (Hard‑coded Password) and CWE‑798 (Use of Hard‑coded Credentials).

Affected Systems

Models E15, M32, R15, and R32 from D‑Link are susceptible; specific firmware versions are not listed. Current official firmware distributed by D‑Link includes the vulnerability.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity; the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The exploit is public and can be launched remotely via the MQTT broker, allowing attackers to authenticate and read or publish messages. No official workaround is published beyond applying firmware updates.

Generated by OpenCVE AI on October 19, 2026 at 15:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update for the device to eliminate hard‑coded MQTT credentials.
  • If an update is not yet available, disable the MQTT broker or block external access to its ports.
  • Replace all default passwords on the device and enforce unique credentials for all MQTT users.
  • Restrict network access to the MQTT broker to trusted internal networks.

Generated by OpenCVE AI on October 19, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink r15
Vendors & Products Dlink
Dlink r15

Mon, 19 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.
Title D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
First Time appeared D-link
D-link e15
D-link m32
D-link r15
D-link r32
Weaknesses CWE-259
CWE-798
CPEs cpe:2.3:h:d-link:e15:*:*:*:*:*:*:*:*
cpe:2.3:h:d-link:m32:*:*:*:*:*:*:*:*
cpe:2.3:h:d-link:r15:*:*:*:*:*:*:*:*
cpe:2.3:h:d-link:r32:*:*:*:*:*:*:*:*
Vendors & Products D-link
D-link e15
D-link m32
D-link r15
D-link r32
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T17:45:45.319Z

Reserved: 2026-10-19T05:29:13.982Z

Link: CVE-2026-112146

cve-icon Vulnrichment

Updated: 2026-10-19T17:45:36.324Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T14:17:02.317

Modified: 2026-10-19T18:17:03.040

Link: CVE-2026-112146

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T19:15:04Z

Weaknesses
  • CWE-259

    Use of Hard-coded Password

  • CWE-798

    Use of Hard-coded Credentials