“admin / admin” and its relatives have caused more IoT compromises than any sophisticated exploit. Default credentials are convenient for setup and support, but they are published in manuals and on forums, so any device reachable from the internet with them is effectively open. Mirai needed nothing more than a list of a few dozen such pairs to build a botnet.
The fix is well understood and is now law in several places. The UK PSTI Act and ETSI EN 303 645 both require that passwords be unique per device or set by the user at first use, and that defaults cannot be reset to a universal value. Printing a random per-unit password on the label, or forcing a change during onboarding, satisfies this at minimal cost.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.