Default credentials

A factory-set password is public knowledge by definition, because it is in the manual.

The lasting problem is not the initial password but everything that makes changing it unlikely: devices deployed in quantity, no process to track them, systems where changing it breaks an integration. UK rules now prohibit universal default passwords on consumer connected devices, which addresses the most egregious version of this.