A placeholder that frequently outlives its purpose
A default credential ships preconfigured on a device or a newly created account, intended purely as a placeholder to be replaced before the device or account enters genuine use. In practice, that final replacement step is skipped often enough — during a rushed setup, or on a device nobody expected would ever face real exposure — that a meaningful share of deployed devices and accounts remain reachable using nothing more than a publicly documented factory setting.
This is rarely a case of the credential being cracked or guessed; it's simply never having been changed in the first place, which makes it a categorically different and often more preventable failure than a genuinely broken authentication mechanism.
Why this scales into a much larger problem than one device
The risk compounds specifically at fleet scale: a single default credential, once documented or discovered, doesn't expose one device — it exposes every device shipped with the same unchanged default, all at once, which is exactly what makes this such a consequential and recurring category of failure rather than an isolated oversight. Forcing a credential change during initial setup, rather than merely recommending one, is the practical fix that doesn't depend on every individual owner remembering to act on a recommendation.