Default passwords must be changed.

Default passwords can easily be compromised by attackers allowing immediate access to the applications.

Identify the application name and version and do an Internet search for the product name and the string "default password".

If default passwords are found, attempt to authenticate with the published default passwords.

If authentication is successful, this is a finding.

Configure the application to use strong authenticators instead of passwords when possible. Otherwise, change default passwords to a DoW-approved strength password and follow all guidance for passwords.