5.3 Common Vulnerabilities and Weak Settings
Default Credentials
Vendor-shipped accounts with published passwords are the weakest setting that exists, because the guessing work ships with the product. Internet-scale bots replay default credential lists against every reachable SSH, management, and admin interface they index; anything internet-facing falls within minutes. Remediation is structural: force a unique credential at first boot, forbid shared device accounts, and manage local administrators with a solution like LAPS so passwords are randomised, rotated, and escrowed rather than remembered.
Missing or Gapped MFA
Passwords alone are replayable: breach dumps and infostealer logs circulate billions of username-and-password pairs, and credential stuffing simply replays them across corporate logins. Multi-factor authentication closes the replay only where it actually covers the door. Attackers hunt the un-MFA'd shadow: legacy protocols, webmail or relay endpoints, service APIs, and conditional-access exemptions for "internal" ranges. Push-approval fatigue is a configuration gap too -- ten prompts at 2 a.m. ends in one approval. The durable fix is a phishing-resistant second factor, FIDO2/WebAuthn or certificate-based authentication with number matching, enforced on every authentication path simultaneously.
Unpatched Layers
Patch debt is a public race: after a CVE disclosure, a proof of concept is usually days away and weaponisation weeks. Prioritise by exposure -- internet-facing first -- and by exploit maturity, where known-exploited catalogs beat raw severity scores, with hard SLAs for exploited bugs. Remember the application layer: web plugins, bundled JavaScript libraries, and document pipelines go unpatched as often as kernels. EDR and virtual patching buy time on the race; they do not remove the flaw.
Open Listener Ports
Every unnecessary listener is a banner grab with a CVE lookup attached: scanners fingerprint the exact version and pick the exploit from a catalog. Debug endpoints, admin panels, and dev servers top the list because nobody remembers they exist. Remediate with default-deny inbound, close what you can, front what you must keep behind a gateway plus MFA, and re-scan externally against an allow-list so a forgotten 0.0.0.0 mapping raises an alert instead of becoming a foothold.
Architecture Diagram
Key Takeaways
- Default credentials are pre-solved guesses: force unique secrets at first boot and escrow local admins.
- MFA only stops replay where it is enforced -- close legacy and conditional-access shadow paths, prefer FIDO2.
- Treat patching as a public race: prioritize internet exposure plus known-exploited evidence, not severity alone.
- Unnecessary listeners are banner-grab catalogs: default-deny inbound and front essentials behind gateway plus MFA.
- All four weaknesses share one remedy: an enforced, monitored configuration baseline with no undocumented exceptions.