[Bug Report]Default Credentials (admin:admin) on [Service Name] – Full Administrative Access

[senoritaaaaaa]

Environment

https://113.44.152.62/

Reproduction link

https://113.44.152.62/

Steps to reproduce

1. Navigate to https://113.44.152.62/

2. Enter admin for the username and admin for the password.

3. Press “Login”.

4. Observe that you are immediately redirected to the administrative dashboard.

Impact:

1. Full device compromise, including the ability to view/manipulate settings, network configuration, and potentially user data.

2. Could be used as a pivot point for further attacks on the internal network.

Remediation:

1. Change the default password immediately to a strong, unique one.

2. If remote management is not needed, disable it or restrict access via firewall rules.

3. Enable login attempt rate limiting or lockout policies.

What is expected?

The admin interface should either disable default accounts or force a password change upon first login. It should not be accessible with the well‑known factory credentials admin:admin.

What is actually happening?

When navigating to https://113.44.152.62/ and entering admin / admin, the user is immediately logged in and granted unrestricted administrative privileges. No password change is enforced, and the default credentials are still active.