Default passwords must be changed.

From Application Security and Development Security Technical Implementation Guide

Associated with: CCI-003109

SV-85025r1_rule Default passwords must be changed.

Vulnerability discussion

Default passwords can easily be compromised by attackers allowing immediate access to the applications.

Check content

Identify the application name and version and do an Internet search for the product name and the string "default password". If default passwords are found, attempt to authenticate with the published default passwords. If authentication is successful, this is a finding.

Fix text

Configure the application to use strong authenticators instead of passwords when possible. Otherwise, change default passwords to a DoD-approved strength password and follow all guidance for passwords.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.