# CVE-2026-112146: D-Link Eagle PRO AI hard-coded MQTT credentials

Source: https://junglewise.ai/threats/cve-2026-112146-a-vulnerability-was-detected-in-d-link-e15-m32-r15-and-r32-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112146 · Severity: high · CVSS 7.4 · Published 2026-10-19

D-Link Eagle PRO AI mesh networking routers and extenders ship with hard-coded credentials (admin/admin) for the embedded MQTT broker used to manage the mesh network. An attacker on the local network can connect to the broker using these credentials to send commands that disrupt the mesh network topology, intercept mesh control messages, or take over the device configuration. This vulnerability affects the E15, M32, R15, and R32 models.

Vendors: [D-Link](https://junglewise.ai/threats/vendors/d-link).

## Quick answers

**Is CVE-2026-112146 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112146 being exploited in the wild.

**How severe is CVE-2026-112146?** High severity, with a CVSS score of 7.4, published 19 October 2026.

**Which products and versions are affected?** D-Link Eagle PRO AI E15 1.20; D-Link Eagle PRO AI M32 1.11; D-Link Eagle PRO AI R15 1.22; D-Link Eagle PRO AI R32 1.10.

**Is there a fix for CVE-2026-112146?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112146 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-112146?** Check whether you run D-Link Eagle PRO AI E15, D-Link Eagle PRO AI M32, D-Link Eagle PRO AI R15 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from hard-coded credentials stored in the commander daemon that configures the MQTT broker at /etc/emDaemon/mosquitto.conf. The broker listens on TCP 1883 with authentication enabled but uses an unchangeable username and password (admin/admin) shared across all devices and firmware versions. An attacker with network access to the mesh network can authenticate to the MQTT broker and publish or subscribe to EasyMesh control topics (acs/set_channel/toOne/#, acs/sitesurvey/toAllMembers/#, acs/memberreport/toMaster/#) to manipulate mesh behavior.

## Affected products

- D-Link Eagle PRO AI R15 1.22
- D-Link Eagle PRO AI E15 1.20
- D-Link Eagle PRO AI R32 1.10
- D-Link Eagle PRO AI M32 1.11

## Timeline

- 2026-10-19: disclosed
- exploited: Exploit code publicly available on GitHub

## References

- [https://github.com/XueDugu/dlink-eaglepro-easymesh-mqtt-credential-evidence](https://github.com/XueDugu/dlink-eaglepro-easymesh-mqtt-credential-evidence)
- [https://github.com/XueDugu/dlink-eaglepro-easymesh-mqtt-credential-evidence/tree/master/poc](https://github.com/XueDugu/dlink-eaglepro-easymesh-mqtt-credential-evidence/tree/master/poc)