Default Credentials

What are default credentials?

Default credentials are usernames and passwords preconfigured by a software vendor or device manufacturer. They are often used for the first login. When they are public and remain unchanged, they may grant access to a device or application without guessing a user-specific password.

Why default credentials remain a way in

Many devices and applications ship with a known username and password, printed in the manual for first setup. When that pair is never changed, it hands full access to anyone who knows the product. The problem is old and still alive because the installed base is enormous: home routers, IP cameras, printers, admin consoles, databases left exposed by mistake.

The Mirai worm showed it at scale in 2016: it spread by trying a list of about sixty default telnet pairs (root/xc3511, admin/admin, root/vizxv and others) against cameras and video recorders. In October 2016 the resulting botnet drove the denial-of-service attack on the DNS provider Dyn, which knocked many services offline across the United States. Mirai’s source code, released the same year, confirmed that the list fit in a few dozen lines.

Regulators eventually addressed it. California’s SB-327 law, in force since 1 January 2020, requires reasonable security on any connected device sold in the state, which in practice forbids a default password shared across all units. The European standard ETSI EN 303 645 (published in 2020) makes “no universal default passwords” its very first provision. The European Union’s Cyber Resilience Act, in force since December 2024 with its obligations applying from 2027, points the same way for products with digital elements.

How the tool works

The data comes from the DefaultCreds-cheat-sheet project (ihebski, MIT). A sync script pinned to a specific commit fetches the CSV file, checks that the licence is still MIT, parses the CSV per RFC 4180, then normalises: vendor names are harmonised for display without losing the original value, duplicates are dropped and markers such as <blank> become an empty value. The frozen dataset is loaded into your browser, where all the filtering happens.

Search ignores case and accents, splits the query into words that must each match, and tolerates spaces and hyphens, so d-link, dlink and d link return the same product. Results are grouped by vendor with the number of pairs, and the export mirrors exactly the selection on screen.

Method on an engagement

The first step is to identify the product: the service banner (SSH, telnet, SNMP), the HTTP Server header, the login page title and logo, the Basic authentication realm. Once the model is known, the pair to try often comes down to two or three values, which avoids multiplying attempts.

Many systems lock an account after a few failures, and a lockout triggered on an administrative account is an incident in its own right, visible to the client. A targeted test, limited to the relevant pairs and spaced out over time, respects that constraint better than a blind dictionary run. Log every attempt, the timestamp and the response: evidence of access through a default credential belongs in the report, and the audit trail protects the tester too.

Limits of the dataset

The cheat sheet is useful but partial. It does not always distinguish firmware versions, regional variants or recent releases, and some entries are really hints (serial number, the last eight digits of the serial number) rather than literal values: the tool flags these and leaves them out of exports. A product that is absent may well have a default pair that is simply not listed here. For an authoritative list, go back to the vendor’s documentation, which now often publishes its defaults, or to specialist databases.

How to defend against it

Change every default credential before going live, printers and UPS units included, and prefer equipment that forces that change at first login, as ETSI EN 303 645 and the Cyber Resilience Act now require. Disable unused service accounts, segment the management network, and keep management interfaces behind a VPN rather than on the public internet. For detection, a rule that surfaces successful logins with a known default credential catches both an oversight and an attacker.