Default Password

What default passwords actually are

A default password is a factory-supplied credential that exists before an operator has configured the device. The problem is not the password format itself, but the predictability of a shared starting point. Once that value is known or left unchanged, the device is effectively operating with a public secret.

Default passwords matter because they create a repeatable and low-effort entry path across large device populations. Attackers do not need a novel exploit when the manufacturer has already provided an initial credential that many owners never replace. In practice, the risk is highest where devices are deployed at scale, are hard to access physically, or remain connected long after installation.

Why default passwords are dangerous

The danger comes from predictability and reuse. A default password is often documented in a manual, visible on a label, or shared across many identical models, which means exposure can begin with simple scanning, credential stuffing against known defaults, or opportunistic access after a reset. Once an attacker authenticates, the device may expose management functions, telemetry, camera feeds, relay controls or network footholds.

In industrial and operational technology environments, the consequences can extend beyond one device. A predictable login can become the first step toward changing settings, disabling alarms, pivoting into adjacent systems or taking control of field equipment. When a default password is still valid, the security boundary depends on obscurity rather than assurance.

That is why product-security guidance increasingly treats default-password elimination as a baseline requirement. NHIMG’s Security by Design and by Default Guide places secure defaults at the centre of modern product security, and the UK PSTI Act Guide explains how regulation now addresses banned default passwords for consumer connectable products.

How organisations should assess exposure

Exposure checks start with asset inventory, because you cannot remove defaults from devices you do not know about. Organisations should identify where devices are deployed, whether they are internet-facing, and whether vendor manuals or installation workflows still expose factory credentials. The same review should include test accounts, dormant admin profiles and reset behaviour, because a reset can silently restore the original password state.

For connected devices, exposure assessment should also consider whether the product family has a known history of default-credential abuse. NHIMG’s Mirai and IoT Botnet Families Guide shows how attackers repeatedly weaponise unchanged defaults at scale, while the Device and IoT Identity Guide covers the broader onboarding and device-trust controls that help prevent default-password exposure in the first place.

Remediation and detection when defaults are still present

Remediation should begin by replacing any shipped credential with a unique secret or a stronger onboarding method as soon as the device is installed. Where a device cannot support that, it needs compensating controls such as network segmentation, restricted management access, vendor coordination, or removal from any untrusted network path. The goal is to stop the default from being an authentication path at all.

Detection should focus on the signs that a default has been guessed or reused, such as unusual logins, failed attempts against common vendor defaults, management access from unfamiliar IP ranges, or new configuration changes shortly after deployment. If exploitation is suspected, treat the device as potentially exposed beyond the login itself and review associated settings, adjacent accounts and any external services the device can reach.

NHIMG’s Securing Your Home Router Guide and pfSense and OPNsense Hardening Guide are useful examples of how default credentials, administrative access and exposed management planes should be hardened in practice.

Where default passwords show up most often

Default-password risk appears most often in consumer IoT, home networking, industrial equipment, cameras, firewalls, lab systems and newly deployed platforms that are intended to be configured later. It also shows up in products that ship with an initial admin account but leave password changes to the operator, which is a fragile assumption when devices are installed in bulk or by third parties.

The common thread is that the manufacturer’s starting state is treated as temporary, but temporary states have a habit of becoming permanent. NHIMG’s ETSI EN 303 645 Consumer IoT Guide and UK PSTI Act Product Security Guide explain why modern product-security rules now push vendors and operators toward secure, unique defaults rather than shared factory credentials.

Related resources from NHI Mgmt Group

• Who should decide the default secret generation method in a password management system?
• When do compliance and deployment requirements justify replacing default self-service password reset options?
• How should teams secure PostgreSQL when there is no default password to rely on?
• What happens when a device is jailbroken and the root password is left at the default value?