Default Credentials

Default credentials are the username and password a device or service ships with from the factory.

Common examples are admin/admin or root with no password at all.

Manufacturers set a default login so the device works out of the box.

The intention is that the owner will change it during setup, but very often nobody does.

Default credentials are usually the same for every device of a model.

Anyone who knows the default can log into thousands of unchanged devices around the world.

Default logins are no secret. They appear in manuals and on public websites.

Attackers keep large lists and simply try each known pair, like admin : password, against a target.

Attackers do not check devices by hand. They run tools that scan the internet and automatically try default credentials on every device they find.

The famous Mirai botnet spread by trying a short list of default logins on IoT devices.

It infected hundreds of thousands and launched record-breaking attacks, all thanks to unchanged passwords.

Some devices have extra accounts users never see, created for support or debugging.

If these keep default passwords, they become a silent backdoor into the device.

The simplest defense is to change every default password immediately during setup.

Use a strong, unique password for each device, not the factory one.

Better devices force the user to set a new password on first use.

This removes the risk of someone forgetting, since the default simply cannot remain.

The strongest approach gives each unit a unique random password from the factory, printed on a label.

Now there is no shared default for attackers to guess.

Organizations should regularly audit their devices for default credentials.

Finding and fixing them before attackers do closes one of the easiest doors into a network.

Why are factory default credentials such a serious risk?

Default credentials are factory logins that are often shared, public, and left unchanged, as the Mirai botnet showed.

Defend by changing them, forcing a change on first use, using unique per-device secrets, and auditing regularly.