How should security teams reduce risk from default passwords on routers and IoT devices?

Security teams should treat default passwords as an immediate exposure point, not a minor setup issue. Change them during initial configuration, enforce unique credentials per device, and verify that consumer and small-office devices cannot remain on factory settings. Combine that with routine checks during asset reviews so forgotten routers, cameras, and similar devices do not become easy entry points for attackers.

Why factory passwords create a real attack path

Default passwords are not just a poor hygiene issue, they are a predictable control failure. On routers and IoT devices, the factory credential is often public, reused across many models, or trivial to infer once the device type is known. That makes initial compromise cheap, especially where the device is internet-facing or sits on a trusted internal network.

The practical problem is that a forgotten default password turns a device into a standing access path. Attackers do not need to bypass a strong control if the strongest barrier was never changed, and that is why routers, cameras, printers, access points, and similar devices are common first-hop targets in small environments.

For connected devices, this is really about basic device identity and trust. Device and IoT Identity Guide is the more complete view of why onboarding, unique device identity, and banned factory passwords belong together rather than as separate tasks.

What good reduction of exposure looks like

The best control is to remove the default state before the device is allowed into service. That means changing credentials during initial setup, using unique secrets per device, and confirming that installers cannot leave the device reachable with factory settings after deployment. Where a device cannot support unique credentials cleanly, that is a procurement or architecture warning sign, not a reason to accept the risk.

Security teams should also treat password replacement as part of onboarding, not a one-time cleanup exercise. Devices get reset, swapped, returned to factory defaults during troubleshooting, or reintroduced from storage, so the control has to survive the lifecycle of the asset, not just the first day it is installed.

Many organisations underestimate how often the problem comes back through operational convenience. Password Security and Password Manager Guide is useful here because the same human shortcuts that drive password reuse also drive weak handling of device logins, shared installer credentials, and ad hoc exceptions.

Why routers and IoT devices need continuous checking

Initial hardening is necessary, but it is not sufficient. Asset inventories, periodic spot checks, and configuration review are needed because small devices are frequently invisible to central teams until something goes wrong. The risk increases when consumer gear is brought into business use, when remote administration is enabled, or when a device is managed by facilities, operations, or a third party rather than by the security team.

Default-password risk also becomes a segmentation problem. If a weak device can reach internal systems, the impact is no longer limited to that single device. A compromised router or camera can become a pivot point, a persistence foothold, or a path to broader discovery, especially where device traffic is trusted by convention rather than actively controlled.

That is why vendor guidance and hardening baselines matter. CISA Secure by Design reinforces the expectation that products should not ship with insecure defaults, while CIS Benchmarks provide the practical hardening mindset teams can apply to network-connected devices where supported.

Risk and Threat Considerations

Default passwords create a direct, low-effort compromise path because they are known, guessable, or reused across devices. Once an attacker finds a single unmanaged device, the result can be credentialed access, lateral movement, or a foothold that survives longer than a transient software exploit.

Failure mechanism: The device remains reachable with factory credentials, or a reset returns it to a known password that no one notices during normal operations.

Impact: Attackers can take control of the device, intercept or redirect traffic, or use it as an internal entry point to reach higher-value systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-1 — Inventory and Control of Enterprise Assets	Default-password risk depends on knowing which routers and IoT devices exist.
	CIS-5 — Account Management	Factory credentials are an account-management weakness on networked devices.
	CIS-12 — Network Infrastructure Management	Routers and similar edge devices need hardened administration and configuration control.
Recommendation — Inventory every connected device so default-password exposure cannot hide outside review. Replace vendor defaults with unique credentials during device commissioning. Harden and review network device administration settings before allowing production access.
NIST CSF 2.0	PR.AA-01 — Identities and Credentials Are Issued, Managed, Verified, Revoked, and Audited	The question centers on changing and verifying device credentials over time.
	ID.AM-01 — Physical Devices and Systems Are Inventoried	Asset review is needed to find forgotten routers and IoT devices with defaults.
Recommendation — Manage device credentials through their full lifecycle, including replacement after reset. Maintain a current inventory so exposed devices are found before they become entry points.
ISO/IEC 27001:2022	A.5.9 — Inventory of information and other associated assets	You cannot remove default-password exposure without identifying the devices in scope.
	A.8.5 — Secure authentication	Default passwords are an authentication weakness on routers and IoT devices.
Recommendation — Keep an accurate asset inventory for all network-connected devices. Require secure authentication settings and eliminate vendor default passwords.

Practitioner Guidance

What to prioritise: Treat any device that still uses a vendor default as an active exposure, then prioritise internet-facing routers, wireless infrastructure, cameras, and remote-managed appliances before lower-impact devices.

What to verify: Confirm that password changes happen during commissioning, that resets are followed by re-hardening, and that the organisation can prove which devices have unique credentials and which do not.

Common mistake: Assuming that “small-office” or “consumer” gear is low risk because it is not a server. In practice, these devices often sit at the edge of trust and are easier to compromise than better-controlled systems.

Practitioner takeaway: The real goal is not just to change a password once, it is to prevent any device from re-entering service in a known-default state and to keep that condition visible over time.