Default Credentials

Default credentials are the factory-set usernames and passwords that ship with software, devices, databases, and frameworks — admin/admin, root with a blank password, well-known service accounts. The anti-pattern is deploying systems with these defaults still active. They are published in manuals and compiled into attacker tools, so they are among the first things scanned for on any exposed system.

Why It Happens

Defaults exist so a product works out of the box, and changing them is an easy step to skip during a rushed setup. Internal or "temporary" deployments are assumed safe and never hardened. Embedded devices and appliances often hide the credential-change step or make it inconvenient. Infrastructure spun up from images or scripts can inherit defaults silently across many hosts.

Why It Hurts

Default credentials offer attackers free, instant access with zero exploitation effort. Automated scanners and botnets (famously Mirai) sweep the internet trying default logins and recruit or compromise anything that answers. A default database or admin password yields full data access or system takeover. Because defaults are identical across all installations, one known set compromises every unhardened deployment. The exposure is trivial to find and devastating in impact.

Warning Signs

• Systems still accept admin/admin, root blank, or documented vendor credentials.
• New deployments have no mandatory first-boot setup forcing a credential change.
• Images, scripts, or containers bake in known default passwords.
• Security scans report default-credential findings.

Better Alternatives

Force a credential change before a system becomes usable: require setting a strong, unique password on first run, and refuse to operate with defaults. Adopt secure-by-default configuration — no enabled accounts with known passwords, services off unless explicitly turned on. Generate unique credentials per deployment (random initial passwords) rather than shipping a shared default. Store and distribute the resulting secrets through a secrets manager instead of hardcoding. Enforce MFA on administrative access as an additional barrier.

How to Refactor Out of It

1. Inventory all systems, devices, databases, and frameworks for default or unchanged credentials.
2. Change every one to a strong, unique secret, stored in a secrets manager.
3. Add a mandatory first-run setup that rejects defaults and requires a strong password.
4. Bake credential rotation into provisioning so cloned images never share a password.
5. Run recurring scans for default credentials across the estate.
6. Disable or remove unused default accounts entirely, and require MFA for admin access.