UCF STIG Viewer Logo

Default passwords must be changed.


Overview

Finding ID Version Rule ID IA Controls Severity
V-70403 APSC-DV-003280 SV-85025r1_rule High
Description
Default passwords can easily be compromised by attackers allowing immediate access to the applications.
STIG Date
Application Security and Development Security Technical Implementation Guide 2017-01-09

Details

Check Text ( C-70857r1_chk )
Identify the application name and version and do an Internet search for the product name and the string "default password".

If default passwords are found, attempt to authenticate with the published default passwords.

If authentication is successful, this is a finding.
Fix Text (F-76639r1_fix)
Configure the application to use strong authenticators instead of passwords when possible. Otherwise, change default passwords to a DoD-approved strength password and follow all guidance for passwords.