Hardcoded Credentials — Explained

This week, Cisco disclosed that attackers have been actively exploiting a static credential embedded in its Secure Firewall Management Center software (CVE-2026-20316). The credential — a low-privilege account baked into the firmware — couldn’t be changed or removed by administrators. Attackers discovered it, logged in remotely, and chained it with other flaws to escalate their access across affected systems.

What are hardcoded credentials?

Hardcoded (or static) credentials are usernames and passwords written directly into a device’s software or firmware by the manufacturer. Unlike accounts you create and manage yourself, these are built in — often for maintenance, diagnostics, or initial setup. In many cases, administrators never know they exist.

The core problem: if the credential is identical on every device running that software, anyone who discovers it can access every single one.

Why this matters beyond Cisco

Most Australian SMBs don’t run a Cisco Firewall Management Center. But the principle applies to every network device in your office. Routers, Wi-Fi access points, NAS drives, CCTV systems, and printers all ship with default admin credentials. Those defaults are published in the manual and indexed online.

In our work across Australian small businesses — particularly hospitality venues and smaller not-for-profits — we regularly find network equipment still running on factory credentials years after installation. Unlike the Cisco FMC flaw, where the credential was hidden in firmware and genuinely couldn’t be changed, most SMB devices simply have a default admin password that nobody rotated after the initial setup. That’s a fix you can action today.

What to do

Audit every network device for default or unchanged credentials. Change them. Enable multi-factor authentication where supported. If a device doesn’t let you change a built-in credential, check with the manufacturer for a firmware update — or consider replacing it.

Need help running a credential audit across your network? Get in touch or see our cybersecurity services.