Default Passwords

Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk.(Source)

CIRT.net – Default Password Database
Consolidation of default passwords for commercial software and hardware products.
SANS Whitepaper – Vendor-Supplied Backdoor Passwords – A Continuing Vulnerability
This SANS whitepaper discusses vendor-supplied passwords that are embedded in software/hardware.
US-CERT – Risks of Default Passwords on the Internet
US-CERT alert that reviews the risk associated with default passwords on internet-connected systems.

CMMC Level 1 Assessment Guide
This document provides assessment guidance for Level 1 of the Cybersecurity Maturity Model Certification (CMMC).
CMMC Level 2 Assessment Guide
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2.
Nikto2 – Web Application Scanner
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items.
NIST SP 800-171A Assessing Security Requirements for Controlled Unclassified Information
The purpose of this publication is to provide procedures for assessing the CUI requirements in NIST Special Publication 800-171.
Open Web Application Security Project (OWASP) – Testing for Account Enumeration and Guessable User Account
The scope of this test is to verify if it is possible to collect a set of valid usernames by interacting with the authentication mechanism of the application.
Open Web Application Security Project (OWASP) – Testing for Default Credentials
This link discusses the process of testing web applications for default credentials.

Resources

Legal