Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Default passwords must be changed.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-70403 | APSC-DV-003280 | SV-85025r1_rule | High |
| Description |
|---|
| Default passwords can easily be compromised by attackers allowing immediate access to the applications. |
| STIG | Date |
|---|---|
| Application Security and Development Security Technical Implementation Guide | 2017-12-18 |
Details
| Check Text ( C-70857r1_chk ) |
|---|
| Identify the application name and version and do an Internet search for the product name and the string "default password". If default passwords are found, attempt to authenticate with the published default passwords. If authentication is successful, this is a finding. |
| Fix Text (F-76639r1_fix) |
|---|
| Configure the application to use strong authenticators instead of passwords when possible. Otherwise, change default passwords to a DoD-approved strength password and follow all guidance for passwords. |