# Default or weak credentials exposed

Shipped default logins, unchanged vendor admin accounts, or weak no-MFA admin access on exposed appliances

_Area: Network devices and IoT. Seen in 2 disclosed reports; latest 2026-08-31. Updated 2026-11-02._

## How it works
A device or appliance ships with an account that already has high privilege — a built-in `sa`, a vendor-created `dba`, a service account like `egnyteservice` — and the password is never changed, is reused from an integrator, or is simply weak. The assumption that breaks is "the operator will harden this before exposure." Often the vendor's own feature forces the exposure: a mobile-app integration opens a database port to the internet, so the default account is reachable by anyone. Because the account is already privileged, no separate escalation step is needed.

## Where it shows up
- Vendor-created non-builtin admin accounts (e.g. `dba`) sitting beside `sa`, both with shipped passwords [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cracks-in-the-foundation-intrusions-of-foundation-accounting-software.md).
- Service accounts for sync/appliance software (`egnyteservice`) with default or MSP-reused passwords [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-06-04-verdantbamboo-just-another-brickstorm-in-the-firewall.md).
- Admin panels on internet-facing appliances reachable without MFA, protected only by a weak password [E1](https://bugbountylibrary.com/r/blog%3Asygnia-co-blog-how-the-safepay-ransomware-group-abused-onedrive-to-steal-data.md).
- Non-standard ports opened for a companion app (e.g. MSSQL on 4243) that expose a database directly [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cracks-in-the-foundation-intrusions-of-foundation-accounting-software.md).
- Sudoers entries granting general-purpose utilities (`tee`) as root to an unprivileged service account [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-06-04-verdantbamboo-just-another-brickstorm-in-the-firewall.md).

## How to review
For every shipped account, ask: is the credential unique per install, and is it forced to change before first use? The invariant: no account with administrative rights is reachable from an untrusted network using a credential that is guessable, shared, or documented. Check the config for default accounts, confirm MFA on admin logins, and confirm the exposed port is actually required. For service accounts, verify the sudoers grant is scoped to specific commands, not general-purpose file writers.

## How finders spotted it
- SOC alert on enumeration commands spawning as children of `sqlservr.exe`; cross-host correlation showed identical scripted commands hitting unrelated companies within minutes, and the ERRORLOG showed ~35,000 brute-force attempts ending an hour before a successful login and `xp_cmdshell` enablement [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cracks-in-the-foundation-intrusions-of-foundation-accounting-software.md).
- IR triggered by suspicious outbound traffic from an appliance VM to a Cloudflare-fronted domain and DoH to 8.8.8.8; snapshots confirmed the C2, then a sudoers review exposed the `tee` grant, and suspect traffic from the MSP's network led the pivot [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-06-04-verdantbamboo-just-another-brickstorm-in-the-firewall.md).
- Investigators correlated browser history, ShellBag artifacts, sustained HTTPS to Microsoft during staging, and MFT records of deleted archives to reconstruct the intrusion [E1](https://bugbountylibrary.com/r/blog%3Asygnia-co-blog-how-the-safepay-ransomware-group-abused-onedrive-to-steal-data.md).

## Variants seen
- Default database admin (`sa`/`dba`) on an exposed MSSQL port, escalated to OS commands via `xp_cmdshell` [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cracks-in-the-foundation-intrusions-of-foundation-accounting-software.md).
- Default SSH service account plus an over-broad sudoers rule giving root [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-06-04-verdantbamboo-just-another-brickstorm-in-the-firewall.md).
- Weak, overprivileged admin account without MFA on an internet-facing VPN appliance [E1](https://bugbountylibrary.com/r/blog%3Asygnia-co-blog-how-the-safepay-ransomware-group-abused-onedrive-to-steal-data.md).

## Impact and severity
High to critical. Default DB admin became OS command execution and host/domain enumeration [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cracks-in-the-foundation-intrusions-of-foundation-accounting-software.md). The service account plus sudoers misconfiguration yielded appliance root, a SOCKS proxy into M365, and re-entry through an exposed firewall admin panel [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-06-04-verdantbamboo-just-another-brickstorm-in-the-firewall.md). The weak no-MFA admin plus a VPN flaw reached domain admin within hours, enabling encryption of 60+ servers [E1](https://bugbountylibrary.com/r/blog%3Asygnia-co-blog-how-the-safepay-ransomware-group-abused-onedrive-to-steal-data.md). Impact rises when the default account is already privileged and the port is internet-exposed.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **FortiGate SSL VPN** (version not stated): Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data. Report: https://bugbountylibrary.com/r/blog%3Asygnia-co-blog-how-the-safepay-ransomware-group-abused-onedrive-to-steal-data.md
- **FOUNDATION Accounting** (MSSQL instance) (version not stated): Cracks in the Foundation: FOUNDATION Accounting Intrusions. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cracks-in-the-foundation-intrusions-of-foundation-accounting-software.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asygnia-co-blog-how-the-safepay-ransomware-group-abused-onedrive-to-steal-data.md
- E2: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-06-04-verdantbamboo-just-another-brickstorm-in-the-firewall.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cracks-in-the-foundation-intrusions-of-foundation-accounting-software.md