Haxoris Wiki

Default Credentials On Devices And Appliances

How Default Credentials On Devices And Appliances works

Default credentials are the vendor-set username and password an appliance ships with, still working because nobody changed them. They live on the management planes that never feel like servers: printer and MFP web consoles, managed switches, iLO, iDRAC and IPMI baseboard controllers, IP cameras, UPS network cards, KVM-over-IP units, wireless LAN controllers, and hypervisor and storage consoles. The pairs are not secret - they are printed in the manual the vendor publishes online.

The attacker needs no exploit: fingerprint the model, read its default pair from the public documentation, and log in. A printer yields stored jobs, the scan-to-folder path and an address book that often holds a domain service account in its LDAP bind config; a BMC yields out-of-band console, virtual media and power control, which is full control of the host below its operating system. It is easy to miss because the appliance is nobody’s server. It is not domain-joined, so no password policy touches it; it is not in the patch cycle, so no scan flags it; and the console works perfectly, so no ticket is ever raised.

Default Credentials On Devices And Appliances in practice

Fingerprint the management planes on the segment

Identify vendor and model before touching any login, so the credential check is aimed rather than sprayed. Service banners, HTTP titles and SNMP sysDescr name the exact appliance read-only.

# Read-only discovery of appliance management planes across the segment
nmap -sV -Pn -n --open \
  -p 22,23,80,161,443,623,3389,5900,8443 \
  10.10.40.0/24 -oA /tmp/appliance-fingerprint

# SNMP sysDescr names the exact model where the public community is still set
snmpget -v2c -c public 10.10.40.11 1.3.6.1.2.1.1.1.0
# port 623 = IPMI RMCP, 5900 = VNC/KVM console, 8443 = many appliance UIs

Map each fingerprint to its documented default pair

Match the model to the pair from the vendor manual. Per-unit factory passwords (a tag on the chassis) are not a fixed string and stay as a placeholder.

fingerprint (nmap -sV / SNMP sysDescr)     documented default pair (vendor manual)
-----------------------------------------  ---------------------------------------
HP LaserJet, "HP-ChaiSOE" HTTP server      admin / <blank>
HPE iLO, "HPE-iLO-Server" banner           Administrator / <per-unit tag on chassis>
Dell iDRAC, "iDRAC" web title              root / calvin
Supermicro IPMI, port 623 open             ADMIN / ADMIN
APC UPS network card, "APC" HTTP title     apc / apc
Axis IP camera, "Axis" server header       root / <set-on-first-boot>

Check the documented pair once, read-only

One attempt with one documented pair, landing on a read-only page. No wordlist and no lockout risk taken; the placeholder holds the pair from the manual.

# Printer web console: single documented pair, discard the body, keep the code
curl -sk -u "admin:<DEFAULT_PW>" \
  https://printer01.lab.internal/hp/device/config -o /dev/null -w '%{http_code}\n'
# 200 -> the shipped pair still authenticates. 401 -> changed, move on.

# BMC over IPMI: lanplus session with the documented pair, read-only status query
ipmitool -I lanplus -H 10.10.40.23 -U ADMIN -P <DEFAULT_PW> chassis status

Show the impact without changing state

Read what the access exposes rather than acting on it. The destructive step - mounting virtual media or releasing a print job - is described, not run.

# Printer: read the LDAP / scan-to-folder config, which often stores a domain
# service account used for address-book lookups and scan-to-email
curl -sk -u "admin:<DEFAULT_PW>" \
  https://printer01.lab.internal/hp/device/net_ldap.xml | grep -i 'bindDN\|server'

# BMC: list users and confirm virtual media and serial-over-LAN are reachable.
# Reading only - mounting an attacker ISO would be the real-world step and is
# out of scope for a safe check, but this proves the capability is present.
ipmitool -I lanplus -H 10.10.40.23 -U ADMIN -P <DEFAULT_PW> user list

How to fix and prevent Default Credentials On Devices And Appliances

  1. Change every shipped credential at enrolment
    • Set a unique, non-default password on the management plane before the device is patched into the network, and record it against the asset register with a named owner.
    • Treat the appliance console as an account no directory policy will ever reach, so nothing downstream will catch it for you.
  2. Move appliance management off the user network
    • Reachability is the multiplier on this weakness; where these consoles live and who can route to them belongs to the Exposed Management Interfaces page.
  3. Replace shared appliance logins with directory-backed identity
    • Where the device supports RADIUS, TACACS+ or LDAP, bind admin access to per-person accounts so the built-in login becomes a break-glass path, not the daily one.
  4. Treat BMCs and hypervisor consoles as tier zero
    • iLO, iDRAC, IPMI and ESXi/vCenter sit below or beside the OS. Rotate their passwords, disable IPMI cipher zero and null users, and restrict them to a management path only.
  5. Rescan for defaults on a schedule
    • Re-run the fingerprint-and-single-pair check after every hardware delivery and vendor visit; new appliances arrive on their defaults continuously.

Last updated

References