Default Credentials and Factory Settings in Breached Infrastructure

Default credentials and unchanged factory settings remain a dependable route into breached infrastructure because the problem is built into how devices are made, deployed and kept in service. Carelessness is an incomplete explanation. Manufacturing incentives create the weakness, long equipment lifetimes preserve it, and operators inherit a problem that password changes and patches alone cannot solve.

Why default credentials remain the most reliably exploited entry point into connected infrastructure

The password “1111” unlocked a programmable logic controller inside a U.S. water utility. That is an absurdly small key for a consequential door, but it was not an ingenious discovery. CyberAv3ngers exploited internet-exposed Unitronics PLCs using a default password published in the product manual. CISA’s advisory describes compromised Unitronics Vision Series PLCs as publicly exposed with default passwords and identifies TCP port 20256 as their default port.

The same weakness runs through consumer botnets, enterprise systems and operational technology. Default credentials still work well as a method of initial access in all these settings because attackers can know the login before sending a single packet. Identical settings turn knowledge about a product into knowledge about many deployed devices. The product manual can become an access guide without changing a word.

Other device limitations make that predictability harder to contain. Connected devices commonly lack the capacity to run security agents, receive firmware updates infrequently and use protocols that security tools cannot parse. An unchanged password can thus leave a way into equipment that is also hard to check or protect. This combination explains why default credentials matter beyond the moment of login.

How the economics of device manufacturing build the vulnerability in before the box ships

Manufacturers optimize for time-to-market and ease of deployment, and shared credentials serve both goals. With a common login, identical devices are easy to install because each unit does not need its own credential process. For a deployment team handling hundreds of devices, that uniformity is convenient. For an attacker, it means one published default can unlock the whole population that still uses it.

The security work is then passed to the operator. Most devices do not require a password change at first boot or offer multi-factor authentication, so users must change the factory’s access settings themselves. In practice, that work often does not happen. Yet the operator has the least leverage over the design decisions that made it necessary. An awareness campaign can explain the burden, but it cannot move the requirement back into the product.

Whether the manufacturer, installer, owner or ISP bears responsibility remains unresolved, and that ambiguity has historically allowed each to defer to the others. This creates a production model that captures the benefit of easy installation while passing the continuing security cost down the chain. That distinction matters because a structural incentive will keep producing the same weakness even when its dangers are well understood.

Why the installed base of vulnerable devices cannot be fixed by patching

A security camera mounted outside a building has an operational lifespan measured in years. A home router may run for five to eight years before it is replaced. Equipment installed before credential requirements took effect can therefore keep running on its original settings long after manufacturers improve how they make devices.

The installed base carrying factory-default credentials is not being meaningfully reduced. Rules for new products do not reach devices already in the field, while some legacy equipment cannot be updated or have its credentials changed without breaking operational dependencies. This is why standard patch management is an incomplete model for the problem. A patch is not a substitute for changing an exposed credential, and some devices offer no practical route to either repair. Their useful operational life outlasts the security assumptions under which they were deployed.

The DOJ announced a March 19, 2026 operation disrupting command-and-control infrastructure used by Aisuru, KimWolf, JackSkid and Mossad. The routers, cameras and DVRs running outdated firmware with default credentials nevertheless remained online and re-infectable. Rebooting clears a Mirai-family infection, but an unchanged credential allows reinfection within minutes because scanning infrastructure returns before the operator does. Evicting the intruder is useful, but it does not change the lock.

What the breach record from 2025–2026 shows about where default credentials actually open doors

At the consumer end, botnet recruitment still depends on credentials that have been publicly known for years. Mirai’s credential table includes root/xc3511 for Xiongmai cameras and root/vizxv for Dahua IP cameras and DVRs. Primary research attributes root/54321 to a Packet8 VOIP phone. These are documented product credentials, and they still underpin active botnet families in 2026.

Between December 2025 and February 2026, SADM, Servicios de Agua y Drenaje de Monterrey, faced an attempt to use a vNode industrial gateway as a potential pathway into operational infrastructure. The gateway had single-password authentication, and segmentation between enterprise IT and OT-adjacent systems was weak. The password-spray attack failed, and no OT breach was confirmed. That distinction is essential because identifying a possible route into operational systems is not the same as successfully taking it.

In December 2025, attackers used exposed web interfaces and default credentials to get into communication and control systems at Polish power sites, including a combined heat and power plant and wind and solar farms. They reset devices to factory settings and changed login passwords. They also set device IP addresses to unreachable values such as 127.0.0.1, locking legitimate users out. Here, factory settings were not merely the entry condition but also part of the disruption.

U.S. officials disclosed in May 2026 that suspected Iranian hackers had breached automatic tank gauge systems at multiple gas stations. The systems were open to the public internet without proper password protection, and attackers changed digital display readings, raising fears that gas leaks could be hidden. In July 2026, attackers got into operational technology networks at water and wastewater utilities in several U.S. states through Rockwell Automation/Allen-Bradley MicroLogix PLCs that were exposed to the internet and had default or weak credentials. They changed passwords and IP addresses to lock operators out. Across this progression, predictable or inadequate authentication moves from recruiting devices into botnets to interfering with the systems that operators use to understand and control physical processes.

How AI tools are changing the effort required to turn a default credential into an OT breach

Specialized knowledge has been an informal barrier between discovering a weak login and recognizing what it might unlock. An attacker still needs to work out what a device is, what it does and how it might lead to operational systems. Commercial AI tools can now do part of that work. The knowledge needed to use a default password can now be acquired by more actors.

The January 2026 activity at SADM illustrates that shift without establishing a successful OT compromise. After an initial IT compromise, the adversary used Anthropic’s Claude for reconnaissance. Claude found that the vNode industrial gateway could be a path toward OT, looked through vendor documentation and made lists of default and victim-specific credentials. The failed password-spray attempt limits what can be claimed about the outcome. It does not erase what the case shows about partially automating credential discovery and OT pathway mapping.

Devices previously sheltered by the obscurity of specialized knowledge are becoming easier for attackers to interpret. AI reduced the expertise needed to investigate their existing weak authentication and network connections, removing friction from a route that was already open.

What the regulatory response addresses and what it structurally cannot reach

Regulation is the most credible way to change manufacturer behavior because it can make secure initial access a condition of selling a product. That changes the supply-side calculation rather than asking every operator to compensate for it afterward. The EU Cyber Resilience Act requires unique credentials or a forced password choice at first boot. Under those requirements, shipping a device with admin/admin is a violation subject to substantial fines.

The timetable matters when describing what the law has accomplished. The rules have separate implementation milestones: new rules on reporting took effect on 11 September 2026, while all the main rules apply from 11 December 2027. The credential requirements address new market entrants. They do not retrofit the equipment that operators already own.

A framework organized around products entering the market has a structural limit: it can improve what ships next, but it cannot by itself change what shipped before. Older devices carry no obligation under the new credential requirements to be recalled or updated. The legacy tail therefore remains outside the remedy for as long as those devices stay in service. Regulation is necessary to stop reproducing the weakness, while organizational controls must address the exposed population it cannot reach.

What organizations operating mixed-vintage infrastructure can actually do now

For operators, the practical starting point is continuous knowledge of what is connected and what it is doing. A one-time audit cannot keep that view up to date across equipment of different ages and with different capabilities. Credential hygiene remains the foundation, including systematic discovery of factory defaults, forced credential changes at deployment and documented credential management for every connected device. That work needs to cover OT-adjacent gateways and sensors that are rarely listed in standard IT asset inventories. A device omitted from the inventory does not become less reachable because its owner has overlooked it.

Credential work then needs a second layer that limits the consequences of a missed or unchangeable password. Network segmentation reduces the area an attacker can reach after compromising a device. The Ohio water facility case illustrates the distinction because a compromised sensor had a path to operational systems, allowing an extended period of undetected dwell time. Segmentation would not have prevented the initial credential compromise. It would have constrained what followed, which is a different and necessary security objective.

Where legacy equipment cannot be updated, or credential changes would break operational dependencies, runtime monitoring becomes especially important. Controls around those devices need to spot unusual traffic patterns, unexpected lateral movement and commands that do not fit what the device does. These controls provide a way to detect misuse where access control and patching cannot carry the whole burden.

The SADM reconnaissance also shows why passive asset visibility alone is insufficient. Commercial AI helped an adversary identify an OT-adjacent gateway and assemble credentials to try against it, making obscure equipment more discoverable from the attacker’s side. Defenders need to use that visibility for active monitoring as well as to keep an inventory. The workable response is therefore to change credentials where possible, contain devices where necessary and watch their behavior continuously.