What 1,677 default passwords say about how network devices actually ship

Every entry in this directory came off a vendor document — a quick-start card, a support note, a CLI reference, a security advisory. As of 17 September 2026 there are 1,677 of them, covering 460 manufacturers and 18 classes of device. That is a small enough pile to count properly, so we counted it: every pair, every blank, and every record where a maker has moved to something that differs per unit.

Snapshot

17 September 2026

Records

1,677

Manufacturers

460

Distinct username/password pairs

654

Most repeated pair

admin / admin — 247 records

Records with no password set

265 (15.8%)

What counts as a record

One record is one credential, for one documented model or model family, on one access method. It carries a manufacturer, a model string, the protocol the credential works over, the privilege level it grants, a username and a password. A record is only published when it traces back to something the vendor wrote down.

Two conventions matter for reading the numbers below. Blank is recorded explicitly rather than left as an empty cell, because leave the username blank and no password is set are different facts about the device. And where a vendor ships a credential that differs per unit, the record says so instead of inventing a string — that gives two sentinel values, unique to your unit and you create this on first boot, which are what make the per-unit shift measurable at all.

Where a vendor documents two behaviours for what looks like one product, both get a record. Dell’s iDRAC9 is the clean example: the standard build ships a per-server password printed on the service tag, and the legacy build option ships root / calvin. Those are two records on the Dell page, because they are two things a technician can be holding.

The corpus is lumpy. 654 distinct pairs cover 1,677 records, and 487 of those pairs occur exactly once. On the manufacturer side, 248 of the 460 makers have a single record and 355 have three or fewer, while the ten largest between them account for 27.3% of everything. You can see the shape on the A–Z index, where the per-brand counts are printed next to each name.

The most repeated username and password pairs

Ranked by how many records use them. Per-unit and set-at-setup placeholders are excluded from the ranking, since neither is a pair anyone could try:

The concentration is the finding. One pair opens 14.7% of the corpus. Five pairs reach 31.1%. Twenty-five pairs — a list you could read off a napkin — cover 43.2%, and a hundred pairs cover 57.2%. After that the curve flattens hard into the 487 singletons, which is where the genuinely odd credentials live.

The brand-spread column carries a second pattern. admin / admin is not one vendor’s habit repeated 247 times; it is 108 separate companies arriving at the same answer. The more specific the string, the more that column gives away. admin / epicrouter appears under twelve brand names — ASMAX, Bausch Datacom, CNET, E-Con, E-Tech, Edimax, JAHT, LG, Micronet, Planet, Sagem and Conexant itself. Nobody at eleven of those companies chose that password. They licensed an ADSL reference design and shipped whatever the chipset vendor’s firmware came with. Badge engineering is the mechanism behind a good part of the repetition in this table.

The strings themselves are short. Excluding blanks and per-unit sentinels, 1,276 records carry a literal shipped password. Their median length is five characters. 64.7% are six characters or fewer and 90.3% are eight or fewer. 1,051 use nothing but lowercase letters and digits; 59 contain a symbol of any kind; nine have the mixed case, digit and symbol combination that these same vendors demand of their users. In 452 records — 27.0% of the corpus — the password is the username again, and in 98 it is the manufacturer’s own name, which is how APC ends up with apc / apc across fourteen product lines.

Blank passwords and devices with no credential at all

265 records — 15.8% — have no password set from the factory. 292 want the username field left empty. 77, spread across 51 manufacturers, need neither: you reach the management interface and you are in.

These are not all antiques. HPE’s ProVision-based switches, the 2530 and 2930 lines among them, have long dropped you straight to a console prompt with no credential of any kind — defensible on a serial port in a locked rack, much less so the moment somebody enables remote management. Moxa’s ioLogik E1200 remote I/O is the adjacent case: username admin, password field empty, which is one keystroke better and no harder to guess. Blank credentials cluster on kit whose designers assumed physical or network isolation, and that assumption tends to outlive the deployment.

1,171 records (69.8%) grant full administrative access; 19 grant read-only or guest, and the remaining 487 sit on vendor-specific tiers the source document does not map cleanly onto either. Whatever else the industry has done about default credentials, shipping a low-privilege default is not a habit it has picked up.

Where the 1,677 records actually sit

Routers and gateways are 68.1% of the corpus. That is a fact about this directory, not about the world — it has been collecting router credentials for twenty years and the other seventeen classes are newer additions. Every corpus-wide number on this page is therefore substantially a statement about routers, and should be read that way.

The small classes are useful for a different reason: they hold few enough makers to check one at a time. Power and facilities kit comes out worst, though not in the way the folklore has it. apc / apc is the superuser default on APC’s Network Management Card 1 and 2 and on the UPS and rack PDU families built around them — the AP9630, AP9631 and AP79XX generation that fills any rack which has been standing a while. APC did move. Schneider’s current FAQ scopes those credentials to NMC1 and NMC2 only, and the NMC3 cards — AP9640, AP9641, AP9643 — no longer ship with them. What the directory records is the distance between those two facts: the card generation changed, the installed base did not. Raritan has not moved at all, and admin / raritan still covers both the Dominion KVM and serial console line and the PX2 and PX3 rack PDUs.

Server management is split. HPE and Dell both went to per-unit credentials, described below. The IBM Integrated Management Module did not: USERID / PASSW0RD — with a zero, not an O — is the documented default across IMM and IMM2, and it carried into Lenovo’s earlier XClarity Controller generations when the x86 server business changed hands. Newer ThinkSystem generations vary by model and several ship a unique password instead, so read the pull-out network access tag before you assume either way.

The shift to per-unit credentials

136 records — 8.1% of the corpus, across 71 of the 460 makers — describe a credential that is not the same on every unit. They split into two mechanisms, and the difference only shows itself when somebody holds the reset button in.

58 records are unique to your unit: the factory generated a password, printed it on the hardware, and burned it into the firmware defaults. HPE’s iLO is the canonical version — iLO 4, 5 and 6 all ship username Administrator with a random eight-character string on the serial label pull tab, and a factory reset restores that string rather than clearing it. Dell’s iDRAC9 and later do the same on the service tag. Xerox uses the device serial number on the AltaLink and VersaLink ranges; Brother prints one on current models beside a Pwd label.

QNAP is the weaker version of the same idea. From QTS 4.4.2 the admin password stopped being admin and became the NAS’s own first MAC address, separators stripped, in upper case. It is unique per unit and printed on the chassis, so it satisfies the letter of the thing. It is also in every frame the box puts on the wire, which is a different security property from eight random characters on a pull tab.

78 records are you create this on first boot: there is no factory password at all, and the device will not do anything useful until you set one. Hikvision has shipped cameras in an inactive state since firmware 5.3.0; TP-Link’s current Archer and Deco firmware and the Omada controllers work the same way, as do Proxmox, TrueNAS and most of the software appliances in the corpus.

24 manufacturers now have no universal pair left anywhere in their documented range — among them Proxmox, NetApp, iXsystems, Hanwha Vision, i-PRO, GL.iNet, Xiaomi, MERCUSYS and Epson. That is 5.2% of makers. Set against 91.9% of records still describing a fixed, identical-everywhere credential, it is a beginning rather than a transition. The regulatory floor is rising underneath it — the UK’s PSTI regime has banned universal default passwords on consumer connectable products since 29 April 2024, and the EU Cyber Resilience Act’s reporting duties started on 11 September 2026 with the substantive requirements following on 11 December 2027 — but neither instrument reaches a rack PDU or a BMC, which is precisely where the corpus shows least movement. We have written up that split separately in universal versus unique default passwords and what PSTI and the CRA actually require.

What still matches the Mirai list

The leaked Mirai source contains 62 add_auth_entry() calls in scanner.c, which reduce to 60 distinct pairs once the two duplicates are removed. Matched against the corpus exactly as written, case-sensitively:

• 29 of the 60 pairs — 48.3% — are in the directory today.
• Those 29 pairs account for 551 records, 32.9% of the corpus.
• They appear under 216 manufacturer names, 47.0% of all makers listed.

Ten years on, a credential list written to scan for Chinese DVR firmware still opens a third of everything a vendor has documented. The bulk of that is the boring end of the list — admin/admin at 247 records, admin with no password at 97, admin/password at 53 — but the tail matches too: ubnt/ubnt, admin/smcadmin on SMC, admin/meinsm, root/ikwb.

The 31 pairs that do not match are the more interesting half, and they come from one family: root/xc3511, root/vizxv, root/xmhdipc, root/juantech, root/hi3518, root/Zte521, root/klv1234. Those are the credentials Mirai was actually built for, and they are absent for a structural reason: this directory only publishes what a vendor wrote down. Those strings were never in a manual; they were baked into OEM camera and DVR firmware by contract manufacturers who never told the brands reselling the hardware. A documentation-sourced corpus cannot see them, and no directory built the way this one is ever will.

Method, limits and how to cite this

Everything above was computed over the full published directory as it stood on 17 September 2026: 1,677 records, no sampling. Pair frequencies treat username and password as an ordered tuple and match case-sensitively; relaxing that moves the Mirai overlap from 551 records to 565 and changes nothing else materially. Pair rankings are computed over the 1,540 records carrying a fixed credential, because a per-unit or set-at-setup placeholder is not a credential anyone can try; the shares quoted alongside them are of all 1,677. The literal-password statistics exclude the 136 per-unit records and the 265 blank-password records, since neither has a string to measure. Class figures are the directory’s own classification, one class per record.

Three limits worth stating before anyone builds on these numbers.

1. Documentation bias. A credential exists here because a vendor published it. Undocumented service accounts, hardcoded firmware logins and OEM backdoors are systematically missing, and they are the ones that matter most in an incident.
2. Survivorship. Records are not retired when a product is. A 1998 hub and a 2026 UPS card carry equal weight, so the corpus describes the installed base an administrator might be standing in front of, not what is currently being manufactured.
3. Uneven depth. A maker with 70 records and a maker with one are both one manufacturer. Per-record statistics are weighted towards whoever documents most thoroughly, which correlates with being a large enterprise vendor.

The underlying records are public and browsable by manufacturer on the A–Z index. Quote the snapshot date with any figure you take from it, because the corpus grows: RouterPasswords.com default credential corpus, snapshot of 17 September 2026 (n = 1,677 records, 460 manufacturers). Corrections are welcome and get applied before the next snapshot, so a number quoted here may not reproduce exactly against a later one.