| Titolo | D-Link Eagle PRO AI AX1500 Router (R15) / AX1500 Mesh Extender (E15) / AX3200 Router (R32) / AX3200 Mesh System (M32) R15 1.22, E15 1.20, R32 1.10, M32 1.11 Hard-coded Credentials |
|---|
| Descrizione | The D-Link Eagle PRO AI firmware for the R15 1.22, E15 1.20, R32 1.10 and M32 1.11 models contains hardcoded credentials for its EasyMesh (Multi-AP) MQTT broker. The main control daemon commander writes the fixed account "admin:admin" into /etc/emDaemon/passwd and writes /etc/emDaemon/mosquitto.conf with "allow_anonymous false" and "password_file /etc/emDaemon/passwd" (R32/M32 use "listener 1883 x.x.x.x"; R15/E15 use the equivalent "port 1883"), and then starts EasyMeshDaemon, which launches the shipped mosquitto broker bound to all interfaces on TCP port 1883. Every unit and every listed firmware version uses the same fixed username and password, and the credential is compiled into the daemon rather than stored in a user configuration, so the owner cannot change it. Any party that can reach TCP/1883 (a peer on the LAN, or a node bridged onto the EasyMesh backhaul) can connect with admin/admin and subscribe/publish the EasyMesh control topics the daemon itself uses, for example acs/set_channel/toOne/#, acs/sitesurvey/toAllMembers/# and acs/memberreport/toMaster/#, allowing the mesh control plane to be observed and manipulated. Changing the Web administrator password does not remove the fixed broker credential. Reproduction confirmed that the shipped broker accepts admin/admin (MQTT CONNACK success) while an incorrect password is rejected as "not authorised" and an anonymous connection is refused, and that the shipped default configuration enables the Mesh role so the broker is brought up without any owner action. This issue corresponds to CWE-798, CWE-1188 and CWE-306. D-Link was contacted before this submission. No CVE has been assigned. |
|---|
| Utente | XueDugu (UID 100263) |
|---|
| Sottomissione | 04/10/2026 18:50 (15 giorni fa) |
|---|
| Moderazione | 19/10/2026 07:29 (15 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 422251 [D-Link E15/M32/R15/R32 MQTT Broker /etc/emDaemon/passwd autenticazione debole] |
|---|
| Punti | 20 |
|---|