Devices, appliances or software run with the vendor's default username and password, or with a shared password set at install and never changed. The defaults are published in manuals and collected in public lists, so finding them takes seconds.
At a glance
- Why it matters
- Administrative access with no exploit at all: reconfigure a firewall, read a database, deploy code on an application server or pivot from a printer or camera into the internal network. Defaults on internet-facing interfaces are found by automated scanners within hours.
- How to fix it
- Change every default at install and make it part of the build checklist. Keep an inventory of management interfaces and test it regularly. Use unique credentials per device from a password vault, and remove or disable vendor support accounts you do not need.
Description
Default credentials are the manufacturer or software-vendor username and password (or a default API key, SSH key pair, or access token) left unchanged after deployment. They are publicly documented, often in the product's own manual, and require no reconnaissance beyond identifying which product is running, which recon does as a matter of course: our Open Port Scanner shows which services listen, and our Technology Detector names the web software behind a site.
Impact
Default credentials typically grant full administrative access to whatever they protect: a network device, an admin console, a database, a cloud service account. Because no exploit is required, the same access an attacker gains is exactly what a legitimate administrator has, which usually means the ability to read and change configuration, deploy or replace software, exfiltrate data, and use the compromised system as a foothold for lateral movement into the rest of the network.
How we find it
- We enumerate services during recon and test each identified product against known default-credential lists, treating this as a standard early step rather than an advanced technique, since it costs an attacker nothing either.
- We check for default or weak credentials on management interfaces, database engines, IoT and OT devices, and any service that exposes an authentication prompt we can reach.
- We review configuration exports where in scope for hardcoded default secrets that were changed on the login prompt but left unchanged inside the application's own configuration, a gap that a login-only check would miss.
Fix
Change every default credential before a system goes live, as part of a documented deployment checklist rather than an optional step, and remove or disable default accounts entirely where the platform allows it instead of merely renaming them. Follow with periodic credential audits, since a device re-imaged or reset later can silently reintroduce the default.
! Example hardening checklist for a newly deployed Cisco IOS device
! 1. Create a named admin account, then remove the vendor default one
configure terminal
username netadmin privilege 15 secret <a-strong-unique-secret>
no username cisco
enable secret <a-different-strong-secret>
! 2. Disable unused default services that ship enabled
no ip http server
no ip http secure-server
! 3. Confirm no default account remains
end
show running-config | include username
References
- OWASP Top 10: A07:2021, Identification and Authentication Failures
- CWE-1392: Use of Default Credentials
- CISA: Bad Practices, Use of Known/Fixed/Default Passwords