Why "Welcome1" is still breaching banks in 2026.
The most sophisticated attack is often the least sophisticated. A default password nobody changed, on a system exposed to the internet, remains one of the most dependable routes into a critical platform. Here is why it survives, and how to hunt it.
01Why defaults survive
Every serious platform ships with a way to log in for the first time. A default administrator account, a factory password, a setup wizard. The intent is convenience. The failure is forgetting to close it once the system is live.
Defaults survive because of how systems are really built and run. A device is racked in a hurry before a deadline. A service is installed by one team and inherited by another. A vendor sets up an appliance and hands over the keys without a forced reset. Nobody makes a decision to leave the door open. It is simply never explicitly closed, and there is rarely a control that checks.
02How attackers find them
Finding default credentials does not take a genius. It takes a list and a script. Vendor defaults are public knowledge, documented in manuals and collected in well-known databases. Attackers fingerprint the product, look up its factory credentials, and try them. The whole process is automated and runs continuously across the internet.
This is why exposure and default credentials are such a dangerous pair. A management interface that should never have faced the internet, plus a password that was never changed, is not a subtle chain. It is the front door with the key still in the lock.
03How to hunt them out
The fix is conceptually simple and operationally real work. You cannot close what you cannot see, so it starts with knowing your own estate.
- Inventory every system, appliance, and service that has an administrative login, including the ones a vendor set up for you.
- Force a credential change on first use, and verify it rather than trusting it happened.
- Remove management interfaces from the public internet, and put the ones that must remain behind multi-factor and network controls.
- Test from the outside. An adversarial assessment fingerprints your products and tries known defaults against them, exactly as an attacker would, and tells you which doors are still open.
None of this is glamorous, and that is the point. The attacks that most reliably cause serious breaches are rarely the exotic ones. They are the boring, preventable ones that a disciplined process and an honest external test would have caught.
References
- OWASP Foundation. A07:2021 Identification and Authentication Failures.
- MITRE. CWE-798: Use of Hard-coded Credentials.
- CISA. Known Exploited Vulnerabilities Catalog, on the continued exploitation of weak and default credentials.