Issue Details
Weak, Guessable, or Hardcoded Passwords
iot01 • Rank #1 in OWASP 2023
Explanation
IoT devices frequently ship with well-known default credentials (admin/admin, root/root) or hardcoded passwords that cannot be changed. Attackers use automated scanners to find and exploit these devices at scale, forming botnets like Mirai. Hardcoded credentials in firmware cannot be patched without device replacement.
Remedy
Enforce unique default passwords per device. Require password change on first login. Disable hardcoded credentials and implement secure credential management. Support strong authentication mechanisms and account lockout policies.
| Year | Rank | Category |
|---|---|---|
| 2018 | #1 | iot01 - Weak, Guessable, or Hardcoded Passwords |
| 2022 | #1 | iot01 - Weak Authentication and Access Control |