This vulnerability occurs when a system or device uses a pre-configured, publicly known password for authentication, often for administrative or critical functions.
Manufacturers often ship products with default passwords to simplify initial setup and deployment. While convenient, this practice creates a major security risk if administrators fail to change these defaults, allowing attackers to easily bypass authentication by trying common credentials. Attackers actively use widely available lists of default passwords and automated scanning tools to find and exploit these weak points across many systems. This makes using unchanged defaults a high-risk practice that can lead to widespread, rapid compromise within an organization or across multiple deployments of the same product.
Impact: Gain Privileges or Assume Identity
Effectiveness: High
Effectiveness: Limited
Effectiveness: High
Effectiveness: Moderate