D-Link E15 and three other routers hit by credential flaw

A vulnerability was reported affecting four D-Link router models: the E15, M32, R15 and R32.

The flaw, tracked as CVE-2026-112146 and published October 19, 2026, is a hard-coded credential issue (CWE-798) in the MQTT Broker component, tied to the file /etc/emDaemon/passwd. The record says it can be attacked remotely.

VulDB, acting as the CNA, scored it 7.4 (High) under CVSS 3.1, 6.5 under CVSS 2.0, and 5.3 (Medium) under CVSS 4.0. The CVSS 3.1 vector lists network access, low attack complexity, low privileges required and no user interaction. NVD has not assigned its own score.

Exploit code is public. The CVE record links to proof-of-concept material on GitHub, and VulDB lists the exploit status as proof-of-concept.

The record does not list affected firmware versions. No fix, patch or end-of-life status has been reported for this CVE, and D-Link had not published an advisory for it at the time of writing.

This is separate from CVE-2024-6045, an older D-Link flaw in related router models that D-Link has already addressed.