| Título | D-Link M60 AX6000 Wi-Fi 6 Mesh Router 1.12.B01 Hard-coded Credentials |
|---|
| Descrição | The D-Link M60 firmware 1.12.B01 ships an EasyMesh MQTT broker whose credential is a fixed
compile-time value. At every boot the control daemon /usr/bin/commander writes
/etc/emDaemon/mosquitto.conf:
port 1883
allow_anonymous false
password_file /etc/emDaemon/passwd
/etc/emDaemon/passwd:
admin:admin
and then starts EasyMeshDaemon, which launches the shipped mosquitto 2.0.14 broker (D-Link build).
The broker listens on x.x.x.x:1883 and [::]:1883 with no interface restriction, so any host that
can reach the device's LAN or backhaul side can connect with admin/admin. The password file is
rewritten from the compiled-in constant on every boot, so the owner cannot change or remove it.
We reproduced and confirmed the acceptance against the shipped broker and configuration:
TCP/1883 -> LISTEN x.x.x.x:1883 and [::]:1883
CONNECT username=admin pw=admin -> CONNACK 0x20 0x02 0x00 0x00 (accepted, u'admin')
CONNECT username=admin pw=wrong -> CONNACK 0x20 0x02 0x00 0x05 (not authorised)
CONNECT anonymous -> rejected
Because allow_anonymous false is set, the fixed admin/admin pair is the only credential.
The EasyMesh control plane runs over this broker. EasyMeshDaemon subscribes to topics such as
acs/set_channel/toOne/#, acs/sitesurvey/toAllMembers/# and acs/memberreport/toMaster/#, and the
consumers (EasyMeshDaemon, emhandler, ACSDaemon) run as root. ACSDaemon executes /tmp/acs.sh via
system(); emhandler performs file-driven cp/sync actions for member management and firmware
download; the member firmware download topics drive the upgrade flow. A LAN attacker who connects
with admin/admin can therefore observe and inject mesh control commands (channel changes, member
operations, firmware download triggers) and reach the root-privileged command paths.
This is CWE-798 (Use of Hard-coded Credentials), CWE-1391 (Use of Weak Credentials) and CWE-306
(Missing Authentication for Critical Function).
CVSS 3.1: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS 4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
|
|---|
| Fonte | ⚠️ https://github.com/XueDugu/dlink-m60-easymesh-mqtt-credential-evidence |
|---|
| Utilizador | BenSmith (UID 102206) |
|---|
| Submissão | 19/10/2026 04h07 (há 22 dias) |
|---|
| Moderação | 09/11/2026 18h15 (22 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 433197 [D-Link M60 1.12.B01 emDaemon MQTT Broker mosquitto.conf system Autenticação fraca] |
|---|
| Pontos | 20 |
|---|