Default Credentials Usage
Overview
Default credentials usage refers to the practice of using factory-set usernames and passwords on devices or software without changing them. This vulnerability arises when these preset credentials remain unchanged after deployment, allowing unauthorized access.
Why It Matters
- Security impact: Enables unauthorized access and control over systems, potentially leading to data breaches or system compromise.
- Business risk: Can result in operational disruption, financial loss, and damage to reputation.
- Common consequences: Unauthorized data access, malware installation, lateral movement within networks, and exploitation of additional vulnerabilities.
Where It Appears
- Environments: Enterprise networks, cloud infrastructures, Internet of Things (IoT) ecosystems, and consumer devices.
- Systems or processes: Network equipment, servers, applications, embedded systems, and administrative interfaces.
- Typical conditions: Newly deployed or poorly maintained systems where credential changes have not been enforced or verified.
How It Is Exploited (High Level)
Attackers scan for devices or services using known default credentials and gain access without needing to bypass authentication mechanisms. This initial access can be leveraged to escalate privileges or move laterally within a network.
How It Is Addressed (High Level)
Mitigation involves enforcing credential changes during initial setup, implementing strong password policies, conducting regular audits, and employing access control measures to prevent unauthorized use of default credentials.
Related Topics
Weaknesses such as weak passwords and insecure authentication, attacks including brute force and credential stuffing, and security concepts like access control and identity management.