thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Default Credentials

Factory-set usernames and passwords on applications, devices or services that are publicly documented.

Definition

Default credentials on admin consoles, databases, IoT devices and ICS equipment are among the most exploited weaknesses (the Mirai botnet relied on them). Mitigations include forcing credential change on first use, unique per-device passwords and configuration scanning. Some laws (such as the UK PSTI Act and California SB-327) ban universal default passwords on connected devices.

Example

A camera ships with admin/admin and the setup wizard does not require a change.

Exam tip

Several IoT regulations now prohibit universal default passwords.

Related terms