Default Password

Applies to. Any password that ships with a product or is set by its installer counts: on servers, network devices, payment terminals, wireless access points and the management interfaces of everything in between. 2.2.2 requires the default password on any vendor default account that stays in use to be changed to meet Requirement 8's rules. 2.3.1 applies the same idea to wireless: for any wireless network connected to the CDE or carrying account data, default encryption keys, access point passwords, SNMP defaults and any other security-related vendor default are changed at installation or confirmed to be secure.

Example. A merchant installs a new wireless access point in a store for its payment terminals. The vendor's administrator password and SNMP defaults are printed in the manual. Before the access point goes live the technician changes both and replaces the default encryption key. Under 2.3.1.b the assessor later watches an administrator log in to confirm the printed defaults no longer work.

Limits. Changing a default password does not fix a default account that should not exist; 2.2.2 wants unused accounts removed or disabled, not just given a new password. A default password is also not only the login password: default encryption keys and SNMP defaults are vendor defaults in the same sense under 2.3.1. And a password changed at installation but put back to the default by a factory reset or firmware reload is a default password again; the control is only met while the current value is not the vendor's.