28/9/21 11:53 CRITIFENCE®

The Wayback Machine - https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/

(/WEB/20200417042744/HTTP://WWW.CRITIFENC
 (https://web.archive.org/web/20200417042744/https://www.linkedin.com/company/10684086/)

 (https://web.archive.org/web/20200417042744/https://www.facebook.com/critifence)

 (https://web.archive.org/web/20200417042744/https://www.linkedin.com/groups/8469319)

SCADA Default Password (SDPD)

C R I T I F E N C E ® C R I T I C A L I N F R A S T R U C T U R E , S C A D A , I C S A N D I I O T D E FA U LT P A S S W O R D D A T A B A S E

search device or vendor name...

Looking for more data? for more information about CRITIFENCE API, e-mail to api@critifence.com (https://web.archive.org/web/20200417042744/mailto:
api@critifence.com)

Product Vendor Type Username:Password

AC 800M ABB Controller service:ABB800xA

Ethernet Adapter
SREA-01 ABB admin:admin
Module

Ethernet Adapter
RTU500 ABB admin:admin
Module

netCADOPS Web Application ABB Software 0

Ellipse ABB Software 0

Acoustic Technology,
ATI Emergency Mass Notification Systems Software 0
Inc. (ATI Systems)

ACTi ACTi IP Camera admin/123456 OR Admin/123456

A850 Telemetry Gateway Adcon Telemetry Base Station root:840sw

A850 Telemetry Gateway (ver2) Adcon Telemetry Base Station root:840sw

A440 Wireless Modem Adcon Telemetry Base Station root:840sw

addVANTAGE Pro 6.1, 6.5 Adcon Telemetry HMI root:root

system management
module, intelligent
SNMP-1000, MIC-3924 Advantech advantech:admin
chassis management
module

Advantech WebAccess browser-based HMI and browser-based HMI

Advantech admin:blank
SCADA software and SCADA software

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 1/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

EKI-7659C Advantech industrial switch admin:admin

EKI-7657C Advantech industrial switch admin:admin

Intelligent Ethernet I/O

ADAM-6200 Series Advantech root:00000000
Module

ADAM-6050W Advantech I/O module root:00000000

Root:00000000, Admin:00000000
ADAM-3600-A1F Advantech Remote I/O Module
User:00000000

OmniSwitch 6250 Alcatel-Lucent switch admin:switch

Industrial Ethernet
AT-IE200-6GT (IE200 Series) Allied Telesis manager:friend
Switches

Industrial Ethernet
AT-IE200-6GP (IE200 Series) Allied Telesis manager:friend
Switches

Industrial Ethernet
AT-IE200-6FT (IE200 Series) Allied Telesis manager:friend
Switches

Industrial Ethernet
AT-IE200-6FP (IE200 Series) Allied Telesis manager:friend
Switches

KVGC202/EN/M/E11 Alstom Relays AAAA

MiCOM
Alstom Relays AAAA
P141/P142/P143/P342/P343/P344/P345/P346/P391

Argus Messenger Argus Messenger ArgusAdmin:masterkey

Address Manager
Argus Address Manager Argus argus:argus
Software

ASTUTE140 Meter Astute Medical Analyzer 1234:1234

Axis Axis IP Camera root/pass

CR10 v2 B&B; ELECTRONICS Industrial router root:root

Conel 4.0.1 B&B; ELECTRONICS Industrial router root:root

SPECTRE Router B&B; ELECTRONICS Router root:root

ER75i B&B; ELECTRONICS Industrial router root:root

ER 75i DUO B&B; ELECTRONICS Industrial router root:root

ER 75i SL B&B; ELECTRONICS Industrial router root:root

ER75i v2 B&B; ELECTRONICS Industrial router root:root

LR77 v2 Libratum/LR77 v2 B&B; ELECTRONICS Industrial router root:root

UR5i v2 B&B; ELECTRONICS Industrial router root:root

UCR11-v2 B&B; ELECTRONICS Industrial router root:root

UCR11 v2 SL B&B; ELECTRONICS Industrial router root:root

XR5i v2E B&B; ELECTRONICS Industrial router root:root

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 2/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

XR5i v2 B&B; ELECTRONICS Industrial router root:root

XR5i B&B; ELECTRONICS Industrial router root:root

XR5i SL B&B; ELECTRONICS Industrial router root:root

ES1A B&B; ELECTRONICS Converter root:dbps

Vlinx VESR4x4 B&B; ELECTRONICS SERIAL SERVER

Vlinx MESR9xx Modbus Gateway B&B; ELECTRONICS Modbus Gateway

MediCal QAWeb Agent Barco Client Application Advanced:advanced

IPC@CHIP Beck IPC PLC PPPSERVER:, ppps:ppps

Beckhoff Automation
CX5020 PLC webguest:1
GmbH

Software for the

Beckhoff Automation
TwinCAT Windows control and Administrator:1
GmbH
automation technology

BinTec X1200 II BinTec Elmeg Router admin:bintec,

(##unknown - means not known o

any routers BinTec Elmeg Router ##unknown:snmp-Trap , suggeste
admin:1234, admin:password, ad

BinTec R230aw BinTec Elmeg Router admin:funkwerk

WLAN Access Point

Bintec W2002T-n BinTec Elmeg for applications in admin:funkwerk, admin:admin
rolling stocks

bk3000 BK Ultrasound Ultrasound System administrator:superuser

Electronic
Microprocessor
easy/easy compact/easy split CAREL Controllers, plug-in 22 (access to the parameters)
electronic digital
thermostat

Electronic
Microprocessor
PJ32V/PJ32W/PJ32Z CAREL Controllers, plug-in 22 (access to the parameters)
electronic digital
thermostat

root:froot, carel:fcarel, guest:fgue

httpadmin:fhttpadmin (ftp), admin
pCOWeb CAREL Communication Card passwordless accounts via telnet
http::48:48:HTTP users:/usr/http/
nobody::99:99:nobody:/var/lib/no

Integrated Electronic
Microprocessor 22 (access to the parameters), 66
ir33 (ir33 platform) CAREL
Controllers with LED activation password)
display

Integrated Electronic
Microprocessor 22 (access to the parameters), 66
ir33 power (ir33 platform) CAREL
Controllers with LED activation password)
display

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 3/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

Integrated Electronic
Microprocessor 22 (access to the parameters), 66
ir33 DIN (ir33 platform) CAREL
Controllers with LED activation password)
display

Integrated Electronic
Microprocessor 22 (access to the parameters), 66
powercompact (ir33 platform) CAREL
Controllers with LED activation password)
display

Integrated Electronic
Microprocessor 22 (access to the parameters), 66
powercompact small (ir33 platform) CAREL
Controllers with LED activation password)
display

Integrated Electronic
Microprocessor 22 (access to the parameters), 66
mastercella (ir33 platform) CAREL
Controllers with LED activation password)
display

Pressure, Humidity and 22 (enter and modify parameters

Universal Infrared Series CAREL Temperature and 16 in addition to all ???P??? p
controllers (enter and modify all parameters)

Pressure, Humidity and

IR33-DN33 Universale series CAREL Temperature 77 (Setting type c, d, F parameters
controllers

Compressor Rack user password: 0000, service pas

pRack PR100 CAREL
Controller manufacturer password: 1234

humiSteam x-plus CAREL Humidifiers 77

PlantVisorPRO Locale CAREL Plant supervision admin:admin

Supervisor for small- PVRemote:PD35010 (from a remo

PlantWatchPRO CAREL
medium installations telephone connection)

Direct level: , user level: 22, super

mC2SE CAREL Electronic Controller
factory level: 66

PowerSoft Carlo Gavazzi Modular Software admin:admin, user:user

ClimateWorx
In-Row M52 Microprocessor Controller 1024 (Service level)
International

ClimateWorx
M52 Microprocessor Controller Level 1: 1024, level 2: 4321, level 3
International

Electronic Medical /
ClinicPro EMR ClinicPro Health Records admin:abc123
Software

Electroencephalograph
E-Series EEG (Siesta and Safiro data acquisition
Systems,data
systems and the ProFusion EEG data acquisitionand Compumedics 0000 (security dialogue password
acquisition systems,
analysis software)
HMI software

Electroencephalograph
E-Series EEG/PSG (Siesta and Safiro data acquisition
Systems,data
systems and the ProFusion EEG data acquisitionand Compumedics 0000 (security dialogue password
acquisition systems,
analysis software)
HMI software

Contemporary Control
BASRT-B Router admin:admin
Systems

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 4/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

UR5i Datasensor Router root:root

UR5i SL Datasensor Router root:root

Portable vital signs

S/5 Light Monitor Datex-Ohmeda 16/04/1934
monitor

Advanced Wind turbine root:deif7800 (administrator), def

AWC 500 Deif
Controller (user)

Delta Industrial Automation DOPSoft Delta Electronics Software 0

Delta Industrial Automation Screen Editor Delta Electronics Software 0

DC-ME-01T-S Digi Networking Modules root:dbps

Network Device Server

Digi Connect SP Digi root:dbps
Module

Network Device Server

Digi Connect Wi-SP Digi root:dbps
Module

Network Device Server

Digi Connect ME Digi root:dbps
Module

Network Device Server

Digi Connect ME 4 MB Digi root:dbps
Module

Network Device Server

Digi Connect Wi-ME Digi root:dbps
Module

Network Device Server

Digi Connect EM Digi root:dbps
Module

Network Device Server

Digi Connect Wi-EM Digi root:dbps
Module

Digi Connect ES 4/8 SB with Switch Digi Concentrator root:dbps

Digi Connect ES 4/8 SB Digi Concentrator root:dbps

ConnectPort TS 4x4 Digi Terminal Server root:dbps

ConnectPort TS 4x2 Digi Terminal Server root:dbps

ConnectPort TS W Digi Terminal Server root:dbps

ConnectPort TS 8 Digi Terminal Server root:dbps

ConnectPort TS 8 MEI Digi Terminal Server root:dbps

ConnectPort TS 16 Digi Terminal Server root:dbps

Digi Connect WAN Digi Industrial router root:dbps

Digi Connect WAN GPRS Digi Industrial router root:dbps

Digi Connect WAN GSM-R Digi Industrial router root:dbps

Digi Connect WAN VPN Digi Industrial router root:dbps

Digi Connect WAN IA Digi Industrial router root:dbps

Digi Connect WAN 3G Digi Industrial router root:dbps

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 5/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

Digi Connect WAN 3G IA Digi Industrial router root:dbps

Digi Connect WAN 4G Digi Industrial router root:dbps

Digi TransPort WR21 Digi Industrial router username:password

Digi TransPort WR44 Digi Industrial router username:password

Digi CM Digi Industrial router root:dbps

DigiOne IAP Serial Digi Gateway root:dbps

Programmable
i.LON SmartServer Echelon for ftp and lns servers: ilon:ilon
Modules

Building Energy
Management Solution,
i.LON SmartServer Echelon ilon:ilon
LonWorks/IP Server,
Internet Server

Building Energy
Management Solution,
i.LON SmartServer 2.0 Echelon ilon:ilon
LonWorks/IP Server,
Internet Server

Building Energy
Management Solution,
i.LON 600 Echelon ilon:ilon
LonWorks/IP Server,
Internet Server

Building Energy
Management Solution,
i.LON 100e4 Echelon ilon:ilon
LonWorks/IP Server,
Internet Server

Central Management
LumInsight Echelon Echelon:echeloncorp
System

Electro
Nexus 1500 Power Quality Meter anonymous:anonymous
Industries/GaugeTech

Electro
Nexus 1500+ Power Quality Meter anonymous:anonymous
Industries/GaugeTech

Electro Power Monitoring

Communicator EXT 3.0 eignet:inp100
Industries/GaugeTech Software

AMS Suit Emerson diagnostic software admin:, sa:42Emerson42Eme (SQ

DeltaV Digital Automation System Emerson Automation System Administrator:deltav

Liebert IntelliSlot Web Card Emerson Web Card Liebert:Liebert, User:User

Liebert OpenComms Web Card Emerson Web Card Liebert:Liebert

admin:default, maint:default, oper

Smart Wireless Gateway 1420 Emerson Wireless Gateway
exec:default

for the Windows log in Administra

stand-alone network
for Smart Wireless Navigator log
Smart Wireless Navigator Emerson infrastructure
Supervisor:Admin, User1:Passwo
management tool
User2:Password2, User3:Passwor

Network Power MPH2 Rack PDU Emerson Rack PDUs admin:admin

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 6/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

UL33 UPS Emerson UPS 123456

Control Link Refrigeration System Controller Emerson Controller 0

User 01:100, User 05:200, User 09

UltraSite Emerson Software
Engineer:400

Avocent ACS 6000 Advanced Console Server Emerson Console Server admin:avocent, root:linux

ROCLINK 800 Emerson Software LOI:1000

ControlWave Micro Quick Emerson PLC for download project:, SYSTEM:66

IP-KVM Avocent MergePoint Unity Emerson Switch Admin:blank

Switch for Distributed

Ovation DCS Emerson wdpf
Control System

Switch for Distributed

Ovation DCS Emerson SNMP community string: wdpfRO
Control System

ControlWave Micro Process Automation Controller Emerson PLC 0

Gateway for remote

Fieldgate FXA520 Endress+Hauser monitoring and super:super
diagnosis

Fieldgate Viewer Endress+Hauser HMI software admin:0000

emg12 (for EMG12), emg10 (for E

EMG-10 ENTES MODBUS Gateway
(for EMG02)

emg12 (for EMG12), emg10 (for E

EMG-02 ENTES MODBUS Gateway
(for EMG02)

emg12 (for EMG12), emg10 (for E

EMG-12 ENTES MODBUS Gateway
(for EMG02)

DTR-10 ENTES time relay 0

MCB-125 ENTES time relay 0

MCB-126 ENTES time relay 0

MPR-53CS ENTES network analyzer 0

GPRS/Modbus
GEM-05 ENTES gem10
Gateway

GPRS/Modbus
GEM-10 ENTES gem10
Gateway

GPRS/Modbus
GEM-10SH ENTES gem10
Gateway

Energy Management
ENTBUS PLUS ENTES admin:1234
Software

EPM-04/04C/04CS ENTES MULTIMETER 0

Monitoring & Reporting

MPR-SW ENTES admin:
Software

All eWON Router adm:adm

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 7/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

UPS SNMP HTTP

USHA Falcon USHA:admin
AGENT

V-Server VPR Fuji Electric Software 0

D60 Line Distance Relay GE RTU 0

Sentinel License Manager Gemalto Software 0

Software: admin:admin, 12345 (L

Password), Hardware: 0000 (Adva
Video Streaming
SymDec 4 General Electric Password), 8111 (Factory Passwo
Recorder
(Ethernet Access Reset Password
Password)

Software: admin:admin, 12345 (L

Password), Hardware: 0000 (Adva
Video Streaming
WebServer General Electric Password), 8111 (Factory Passwo
Recorder
(Ethernet Access Reset Password
Password)

Software: admin:admin, 12345 (L

Password), Hardware: 0000 (Adva
Video Streaming
SymNav General Electric Password), 8111 (Factory Passwo
Recorder
(Ethernet Access Reset Password
Password)

Software: admin:admin, 12345 (L

Password), Hardware: 0000 (Adva
Video Streaming
Cimplicity General Electric Password), 8111 (Factory Passwo
Recorder
(Ethernet Access Reset Password
Password)

Software: admin:admin, 12345 (L

Password), Hardware: 0000 (Adva
Video Streaming
CIMPLICITY WebView General Electric Password), 8111 (Factory Passwo
Recorder
(Ethernet Access Reset Password
Password)

General Electric Digital GE:GE (Telnet, HTTP), public (SNM

SNMP/Web Interface SNMP/Web Interface
Energy string)

General Electric
FASTlab Synthesizer Synthesizer Admin:admin
Healthcare

General Electric
TRACERlab FX2 devices (model C, MeI and N) Synthesis module admin:tracerlab (physical access
Healthcare

General Electric tracerlab:tracerlab (for remote ac

TRACERlab FX2 M Chemistry Synthesizer
Healthcare admin:tracerlab

General Electric Computed

HiSpeed CT/i root:#bigguy, ctuser:4$apps
Healthcare Tomography Scanner

General Electric Computed

Lightspeed QX/i root:#bigguy, ctuser:4$apps
Healthcare Tomography Scanner

General Electric Computed

Discovery CT590 RT root:#bigguy
Healthcare Tomography Scanner

General Electric Computed

Optima CT580 root:#bigguy
Healthcare Tomography Scanner

General Electric
Datex-Ohmeda Engstrm Ventilator Carestation Ventilators 23-17-21 (Super User), 34-22-14 (
Healthcare

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 8/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

General Electric
IC695PNC001 PROFINET Controller admin:system
Intelligent Platforms

General Electric
IC695ECM850 IEC 61850 Client admin:system
Intelligent Platforms

Ethernet
General Electric
IC695ETM001 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC695CPE305 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC695CPE310 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC695CPE330 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC698ETM001 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC698CPE010 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC698CPE020 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC698CRE020 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC698CPE030 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC698CPE040 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC698CRE030 module/programmable system
Intelligent Platforms
controller

Ethernet
General Electric
IC698CRE040 module/programmable system
Intelligent Platforms
controller

Programmable
General Electric
IC698CPE030 controller with built-in user:system
Intelligent Platforms
web server

Programmable
General Electric
IC698CPE040 controller with built-in user:system
Intelligent Platforms
web server

Programmable
General Electric
IC698CRE030 controller with built-in user:system
Intelligent Platforms
web server

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 9/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

Programmable
General Electric
IC698CRE040 controller with built-in user:system
Intelligent Platforms
web server

General Motors (GM),

SOS iOS Client Software 0
Shanghai OnStar (SOS)

Reliance SCADA Geovap Software 0

Grandstream Grandstream IP Camera admin/admin

gateway between the

Netmonitor Heatmiser outside world and admin:admin
heating system

Ethernet Gateway for

NETLink PRO HW 1-1a-1 and FW 1. 54 and higher Helmholz Systeme NETLink PRO PoE:admin
MPI/PROFIBUS

RS20 Hirschmann Switch user:public, admin:private

RS30 Hirschmann Switch user:public, admin:private

MICE Hirschmann Switch user:public, admin:private

RSP 20 Hirschmann Industrial router user:public, admin:private

RSP 25 Hirschmann Industrial router user:public, admin:private

RSP 30 Hirschmann Industrial router user:public, admin:private

RSP 35 Hirschmann Industrial router user:public, admin:private

MACH 4000 Family Hirschmann Industrial router user:public, admin:private

MACH 1000 Family Hirschmann Industrial router user:public, admin:private

MACH 100 Family Hirschmann Industrial router user:public, admin:private

MACH 4002 Family Hirschmann Industrial router user:public, admin:private

MACH104 Family Full Gigabit Hirschmann Industrial router user:public, admin:private

MACH 1040 Family Full Gigabit Hirschmann Industrial router user:public, admin:private

OCTOPUS 8M Hirschmann Industrial router user:public, admin:private

OCTOPUS 16M Hirschmann Industrial router user:public, admin:private

OCTOPUS 24M Hirschmann Industrial router user:public, admin:private

Industrial ETHERNET
EAGLE 20 Hirschmann admin:private, user:public
Firewall

Hirschmann Automation
Classic Platform Switches and Control GmbH, a Network user:public, admin:private
division of Belden Inc.

Ultrasound Diagnostic
EUB-550 Hitachi Service Tools:SERVICETOOL
Scanner

Web Controller Hitachi Controller admin:1111

HollySys Automation
LK SERIES PLC PLC FTP blank, Telnet blank
Technologies

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 10/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

Honeywell XL Honeywell Controller Guest:guest, SysAdmin:honey

BACtalk control
Alerton BCM-WEB Honeywell module, Web server pass
and Configurator CD

NetAXS Honeywell Access Control Unit admin:admin

IQinVision IQinVision IP Camera root/system

solar inverter, storage

PIKO-Inverter 3.0, 3.6, 4.2, 5.5, 7.0, 8.3, 10.1 Kostal Solar pvserver:pvwr
system

solar inverter, storage

PIKO BA Storage System Kostal Solar pvserver:pvwr
system

EDS-MD 4 Lantronix Medical Device Server admin:PASS

EDS-MD 8 Lantronix Medical Device Server admin:PASS

EDS-MD 16 Lantronix Medical Device Server admin:PASS

L-DALI DALI Light Controller LOYTEC Electronics Multiple Devices admin:loytec4u

L-INX Automation Server LOYTEC Electronics Multiple Devices admin:loytec4u

L-GATE Universal Gateway LOYTEC Electronics Multiple Devices admin:loytec4u

L-IP CEA-709/IP Router LOYTEC Electronics Multiple Devices admin:loytec4u

L-VIS LOYTEC Electronics Multiple Devices admin:loytec4u

LIOB-10x I/O Module LOYTEC Electronics Multiple Devices admin:loytec4u

LIOB-x5x I/O Module LOYTEC Electronics Multiple Devices admin:loytec4u

LIP-ME20X L-IP BACnet Router LOYTEC Electronics Multiple Devices admin:loytec4u

LWEB-802 Building Management System LOYTEC Electronics Multiple Devices admin:loytec4u

LWEB-803 Building Management System LOYTEC Electronics Multiple Devices admin:loytec4u

LWEB-900 Building Management System LOYTEC Electronics Multiple Devices admin:loytec4u

L-Proxy CEA-709 Gateway LOYTEC Electronics Gateway admin:admin

NetBeacon Element Management Software Metrobility HMI Software guest:guest, admin:admin, root:ro

PLC QnUCPU QnUDVCPU Mitsubishi PLC MELSEC:MELSEC

PLC QnUCPU QnUDE(H)CPU Mitsubishi PLC QNUDECPU:QNUDECPU

MES3-255C-EN Mitsubishi Web server ecoV:ecopass, guest:user

Mobotix Mobotix IP Camera admin/meinsm

Industrial 802.11n
AirWorks AWK-3131-RCC Moxa wireless admin:root
AP/bridge/client

Railway Remote I/O (ioLogik E12xx) Moxa Remote Ethernet I/O HTTP on Port 9020: 1)none:root, 2

Railway Remote I/O (ioLogik E15xx) Moxa Remote Ethernet I/O HTTP on Port 9020: 1)none:root, 2

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 11/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

administrator:blank, Telnet on por

Cellular Micro RTU Controller (ioLogik W53xx, ioLogik) Moxa micro RTU controller
root:root

Industrial Video
VPort 461 Industrial Video Encoder Moxa admin:admin, :
Encoder

Embedded computers
are designed for telnet root:root, FTP root:blank, PP
IA240 Embedded computer Moxa
industrial, automation serial console root:root
applications

Embedded computers
are designed for telnet root:root, FTP root:blank, PP
IA241 Embedded computer Moxa
industrial, automation serial console root:root
applications

OnCell Central Manager Moxa Software admin:admin

EDS-505A Series Moxa Switch admin:

EDS-508A Series Moxa Switch admin:

HTTP admin:admin, HTTP Admin

OnCell G3100 Series Moxa Cellular IP Gateways
admin:

MXview Moxa Software 0

PCS-9611 Nari PLC 0

3G21WB (BigPond Firmware) Netcomm Wireless Router admin:admin

3G9WB (BigPond Firmware) Netcomm Wireless Router admin:admin

N3G001W (Netcomm Firmware) Netcomm Wireless Router admin:admin

NB14WN (Netcomm Firmware) Netcomm Wireless Router admin:admin

NB5 (Netcomm Firmware) Netcomm Wireless Router admin:admin

NB5Plus4 (Netcomm Firmware) Netcomm Wireless Router admin:admin

NB6Plus4 (Netcomm Firmware) Netcomm Wireless Router admin:admin

NB6Plus4W (Netcomm Firmware) Netcomm Wireless Router admin:admin

NNB7 (Netcomm Firmware) Netcomm Wireless Router admin:admin

NB9WMAXX (Netcomm Firmware) Netcomm Wireless Router admin:admin

NP804N (Netcomm Firmware) Netcomm Wireless Router admin:admin

NB1300 Plus 4 (Netcomm Firmware) Netcomm Wireless Router admin:password

NP803N (Netcomm Firmware) Netcomm Wireless Router admin:password

4G LTE Light Industrial M2M Router Netcomm Wireless Router admin:password

Linear eMerge E3 Series Nortek Access Control 0

SuperView NOVUS AUTOMATION SCADA superview:superview

Dual SIM Industrial

AirGate-3G NOVUS Automation admin:admin
Cellular VPN Router

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 12/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

1111 (ACESS PASSWORD), 9 3 2 1

N1040 NOVUS Automation Temperature Controller
PASSWORD)

1111 (ACESS PASSWORD), 9 3 2 1

N480D NOVUS Automation Temperature Controller
PASSWORD)

1111 (ACESS PASSWORD), 9 3 2 1

N960 NOVUS Automation Temperature Controller
PASSWORD)

1111 (ACESS PASSWORD), 9 3 2 1

N1020 NOVUS Automation Temperature Controller
PASSWORD)

1111 (ACESS PASSWORD), 9 3 2 1

N1040i NOVUS Automation Temperature Controller
PASSWORD)

1111 (ACESS PASSWORD), 9 3 2 1

N1540 NOVUS Automation Temperature Controller
PASSWORD)

1111 (ACESS PASSWORD), 9 3 2 1

N2000 NOVUS Automation Temperature Controller
PASSWORD)

1111 (ACESS PASSWORD), 9 3 2 1

N3000 NOVUS Automation Temperature Controller
PASSWORD)

1111 (ACESS PASSWORD), 9 3 2 1

N120 NOVUS Automation Temperature Controller
PASSWORD)

Medical Speech
Dragon Medical 360 Network Edition Nuance Recognition Software admin:password
Solutions

NS-Series Programmable Terminals Web Interface

Programmable
(NS12-TS01-V2, NS10-TV01-V2, NS8-TV01-V2, NS5- Omron default:default
Terminals
SQ11-V2, NS5-TQ11-V2 and NS5-MQ11-V2)

CX-Supervisor Omron Software 0

CX-One Omron Software 0

CJ1M CPU Units with Ethernet Functions Omron IA PLC for http: ETHERNET, for ftp: CONF

PI Vision OSIsoft Software 0

PI Data Archive OSIsoft Software 0

EH-net server Ouman HMI Software admin:admin

PEPPERL+FUCHS/ecom
WLAN capable devices using the WPA2 Protocol Network 0
instruments

JouleTemp Phasefale Controls PLC admin:pass

Logic+ PHOENIX CONTACT Software admin:admin

FL SWITCH PHOENIX CONTACT Network admin:admin

FL COMSERVER PHOENIX CONTACT Software 0

license plate (Telnet), wl_test:wl_test, vesstore:

AUTOPLATE PIPS Technology
recognition system ftp_boot:ftp_boot (FTP)

Industrial Cellular
ICX30-HWC Prosoft Technology admin:password
Gateway

FactoryTalk Alarms and Events Rockwell Automation Software 0

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 13/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

EtherNet/IP
Rockwell Automation /
1756-EN2TSC communication Administrator:admin
Allen-Bradley
module

Rockwell Automation /
1734-AENT I/O Adapter admin:password
Allen-Bradley

Rockwell Automation /
1756-EWEB Web Server Module Administrator:
Allen-Bradley

Rockwell Automation /
1768-EWEB Web Server Module Administrator:
Allen-Bradley

HTTP: blank:ZYPCOM, Telnet: bla

Rockwell Automation /
9300-RADES Industrial Modem FTP: uploader:ZYPCOM, CHAP/PA
Allen-Bradley
ppp_user:ZYPCOM

Rockwell Automation / HTTP: blank:ZYPCOM, Telnet: bla

9300-8EDM Industrial Switch
Allen-Bradley FTP: uploader:ZYPCOM

Rockwell Automation / guest:guest, administrator:ml140

MicroLogix 1100 Embedded Web Server Web Server
Allen-Bradley 1400), administrator:ml1100 (Mic

Rockwell Automation / guest:guest, administrator:ml140

MicroLogix 1400 Embedded Web Server Web Server
Allen-Bradley 1400), administrator:ml1100 (Mic

PanelView Plus 6 Graphic Terminals, Firmware 6.10 or Rockwell Automation /

SCADA password
later/, PVPlus 6 Allen-Bradley

To read data 1111:1111, To chang

TROVIS 5590 Web Module SAMSON GROUP Web Module
4444:4444

Data Management
Integrated Management System DMS Samsung root:rkwjsdusrnth
Server

Integrated Management System S-NET mini Samsung S-NET IMS DMS Connection: 0000 or 1234

Power Monitoring
PowerLogic Series 800 Power Meter (PM800) Schneider Electric 0
Module

Power Monitoring
PowerLogic Series 800 Power Meter (PM820SD) Schneider Electric 0
Module

Power Monitoring
PowerLogic Series 800 Power Meter (PM870SD) Schneider Electric 0
Module

Power Monitoring
PowerLogic Power Meter Schneider Electric 0
Module

Energy and power

PowerLogic ION7550 Energy and power meter Schneider Electric 0
meter

Energy and power

PowerLogic ION7650 Energy and power meter Schneider Electric 0
meter

Energy and power

PowerLogic ION8650 Energy and power meter Schneider Electric 0
meter

Integrated gateway-
PowerLogic Ethernet Gateway EGX100 Schneider Electric Administrator:Gateway
server

Integrated gateway-
PowerLogic Ethernet Gateway EGX300 Schneider Electric Administrator:Gateway
server

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 14/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

PowerLogic EGX200 (with firmware version 5.5 or Administrator:admin, User 1:mast

Schneider Electric gateway-server
higher) 2:engineer, User 3:operator

PowerLogic EGX400 (with firmware version 5.5 or Administrator:admin, User 1:mast

Schneider Electric gateway-server
higher) 2:engineer, User 3:operator

ftpuser/password,
Modicon Quantum Schneider Electric PLC
qbf77101/hexakisoctahedron, US

ntpupdate:ntpupdate (Using an FT
your rules in the file:,
/FLASH0/wwwroot/conf/NTP/cu
Modicon M340 Schneider Electric PLC
USER:USER (FTP Setup page via H
credentials), sysdiag:factorycast@
(FTP)

ntpupdate:ntpupdate (Using an FT
your rules in the file:,
/FLASH0/wwwroot/conf/NTP/cu
Modicon M340 for Ethernet Schneider Electric PLC
USER:USER (FTP Setup page via H
credentials), sysdiag:factorycast@
(FTP)

FTP: sysdiag:factorycast@schnei
Modicon Premium Schneider Electric PLC
USER:USER

PowerLogic PM8000 Power Meter Schneider Electric PLC Physical: 0, FTP: 8000:

PowerLogic PM8240 Power Meter Schneider Electric PLC Physical: 0, FTP: 8000:

PowerLogic PM8243 Power Meter Schneider Electric PLC Physical: 0, FTP: 8000:

PowerLogic PM8244 Power Meter Schneider Electric PLC Physical: 0, FTP: 8000:

HTTP Server, PAP Protocol: USER

TSX ETG 1000 Schneider Electric PLC wsupgrade:wsupgrade, Serial Con
Administrator:Gateway

ETG100 Schneider Electric PLC Administrator:Gateway

M258 Schneider Electric PLC adm:adm

pcfactory:pcfactory, loader:fwdow
ntpupdate:ntpupdate,
sysdiag:factorycast@schneider, te
webserver:webpages, fdrusers:sre
nic2212:poiuypoiuy, nimrohs2212
nip2212:fcsdfcsd, noe77111_v50
Quantum NOE 771 xx Schneider Electric Ethernet Modules
(password hashed), AUTCSE:RybQ
(password hashed), AUT_CSE:cQd
(password hashed), target:RcQbR
(password hasshed), FTP and HT
USER:USERUSER, USER:USER, ftp
(FTP)

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 15/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

pcfactory:pcfactory, loader:fwdow
ntpupdate:ntpupdate,
sysdiag:factorycast@schneider, te
webserver:webpages, fdrusers:sre
nic2212:poiuypoiuy, nimrohs2212
nip2212:fcsdfcsd, noe77111_v50
CitectSCADA Schneider Electric Ethernet Modules
(password hashed), AUTCSE:RybQ
(password hashed), AUT_CSE:cQd
(password hashed), target:RcQbR
(password hasshed), FTP and HT
USER:USERUSER, USER:USER, ftp
(FTP)

StruxureOn Gateway Schneider Electric Proxy Server 0

Pelco VideoXpert Enterprise Schneider Electric Other 0

Triconex Tricon, model 3008 Schneider Electric Safety System 0

Simatic S7-300 (pre-2009 versions) Siemens PLC Hardcoded password: Basisk:Bas

Simatic S7-1200 Siemens PLC admin:blank

Simatic S7-1500 Siemens PLC admin:blank

Industrial Ethernet admin:admin (HTTP), user:user (H

Scalance X-200 Siemens
Switches siemens:siemens (FTP)

Industrial Wireless
admin:admin (HTTP), user:user (H
W788-1PRO Siemens LAN, Industrial
siemens:siemens (FTP)
Ethernet Switches

Industrial Wireless
admin:admin (HTTP), user:user (H
W788-2PRO Siemens LAN, Industrial
siemens:siemens (FTP)
Ethernet Switches

Synco living Web server OZW772 V2.0 Siemens Web-server Administrator:Password

winccd:winccpass, wincce:winccp
Siemens WinCC 7.x Siemens HMI Software DMUser:Data&Pass;,
Administrator:Administrator

Ruggedcom RMC30 Siemens Industrial router admin:admin, operator:operator, g

root:admin (service), admin:admin

RUGGEDCOM ROX II for RX1500, RX1501, RX1510, Ethernet Switches
Siemens (administrator), oper:oper (operat
RX1511, RX1512 Layer 3 / Routers
guest:guest (guest)

RuggedSwitch RS8000 Siemens Industrial router admin

RuggedSwitch RS1600 Siemens Industrial router admin

RuggedSwitch RS900 Siemens Industrial router admin

Siemens ST950 Siemens Intersection controller root:zP2wxY4uE

Level 6 End users: 1000 (Physical

Siemens Climatix Siemens PLC Service operator: 2000 (Physical),
6000 (Physical), Web: ADMIN:SBT

Sicam SGU Siemens RTU 642935177

Sicam SGU Siemens RTU admin@root:charleM!800

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 16/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

Patient Monitors
SC 7000 Siemens 4712 (passcode, physical access
Service

Patient Monitors
SC 9000XL Siemens 4712 (passcode, physical access
Service

Industrial Products (Multiple) Siemens Multiple 0

TeleControl Server Basic Siemens RTU 0

SWT3000 Siemens Software 0

TIM 1531 IRC Siemens Software 0

Building Technologies Products Siemens Other 0

AirLink Sierra Wireless 3G/4G gateway sconsole:12345

AirLink Sierra Wireless 3G/4G gateway user:12345, viewer:12345

Web-Server for
eSolar Sinapsi photovoltaic admin:admin
applications

ICS device for data

Sunny WebBox SMA Solar Technology Installer:sma
logging

Administrator, highest authorizati

Stulz WIB 8000 Stulz GmbH PLC Medium authorization: kallisto, Lo
authorization: europa

TAC Xenta 500/700/911 TAC AB PLC root:root

TAC Xenta 913 TAC AB PLC root:root

TAC Xenta 511 TAC AB PLC root:root

TAC Xenta 527 TAC AB PLC root:root

Samsung Techwin Techwin IP Camera admin/4321 OR admin/1111111

0:0 (role 0) , 1:1 (role 1), 2:2 (role 2

Tecomat Foxtrot Tecomat PLC 4:4 (role 4), 5:5 (role 5), 6:6 (role 6
8:8 (role 8), 9:9 (role 9)

Advanced Traffic
ATMS.now Trafficware naztec:naztec
Management System

TRENDnet TRENDnet IP Camera admin/admin

Software for JACE-2,

NiagaraAX (ver 1) Tridium tridium:niagara
JACE-403 or JACE-545

Software for JACE-2,

NiagaraAX (ver 2) Tridium tridium:niagara
JACE-403 or JACE-545

Software for JACE-2,

NiagaraAX (ver 3) Tridium tridium:niagara
JACE-403 or JACE-545

Software for JACE-2,

Niagara Tridium tridium:niagara
JACE-403 or JACE-545

BL20-E-GW-EN Turck PLC HTTP: password, FTP: (unspecifie

BL67-E-GW-EN Turck PLC HTTP: password, FTP: (unspecifie

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 17/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

Web Management
AirControl Ubiquiti ubnt:ubnt
Application

AirOS Ubiquiti operation system ubnt:ubnt

Vivotek Vivotek IP Camera root/

WAGO-I/O-SYSTEM??750 Wago Controller admin:wago, user:user, guest:gue

Compact Industrial http, ftp:, user:user00 , administra

WAGO-I/O-IPC 758-870/000-xxx Wago
PC? su:ko2003wa

Modular I/O-System Linux Fieldbus Coupler 750-860 Wago PLC root:wago , admin:wago, user:use

PFC200 Series WAGO PLC 0

Roll-over car wash 00001 (limited access), 00000 (un

SoftCare Evo Type SE10 WashTec
system access)

WebcamXP WebcamXP IP Camera admin/

administrator:administrator (role
KingSCADA 3.0 Wellintech Software
KVAdministrator)

no password, just return, Hardcod

TDW 33 Westermo Industrial Modem
n3Y9kA6otYZu8, (?? TD-36)

MRD-305-DIN Westermo Industrial router admin:westermo

MRD-310 Westermo Industrial router admin:westermo

MRD-315 Westermo Industrial router admin:westermo

MRD-330 Westermo Industrial router admin:westermo

MRD-355 Westermo Industrial router admin:westermo

MRD-350 Westermo Industrial router admin:westermo

MRD-455 Westermo Industrial router admin:westermo

RedFox Series Westermo Industrial router admin:westermo

Wolverine Series Westermo Industrial router admin:westermo

Lynx Series Westermo Industrial router admin:westermo

Falcon Series Westermo Industrial router admin:westermo

Viper Series Westermo Industrial router admin:westermo

Intouch Wonderware SCADA Administrator:Wonderware

SQL Server Login: aadbo:pwddbo

wwdbo:pwddbo, aaAdmin:pwAdm
Historian Wonderware SQL Server wwAdmin:wwAdmin, aaPower:pw
wwPower:wwPower, aaUser:pwUs
wwUser:wwUser

Integrated
System Platform/Archestra Wonderware Development administrator:blank
Environment

IP Cameras and DVRs Xiongmai Technology Other 0

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 18/20
28/9/21 11:53 CRITIFENCE®
Product Vendor Type Username:Password

442SR Xzeres small wind turbine MyTurbine:m442+SRt

Wireless Management
YFGW410 gateway Yokogawa admin:!admin
Station

Administrator 1:Admin1, Administ

DX1000 Yokogawa Software 2:Admin2, ..., Administrator 5:Adm
1:User01, ..., User 90:User90

Administrator 1:Admin1, Administ

DX1000N Yokogawa Software 2:Admin2, ..., Administrator 5:Adm
1:User01, ..., User 90:User90

Administrator 1:Admin1, Administ

DX2000 Advanced Yokogawa Software 2:Admin2, ..., Administrator 5:Adm
1:User01, ..., User 90:User90

Distributed Control
CENTUM CS 3000 DCS Yokogawa CENTUM:CENTUM
System

EJX910A Multivariable Transmitter HART Multivariable YOKOGAWA. (to release the Write
Yokogawa
Communication Type transmitter mode),

Precision Power
WT 3000 Driver Yokogawa anonymous:blank (Ethernet acces
Analyzer

CENTUM series and Exaopc Yokogawa OPC 0

Vital Sign Monitor With

Nightingale PPM3 Zoe Medical Set Dial 1 to 49, Set Dial 2 to 48, S
CO2

Credits and Thanks

toolswatch - DPE Default Password Enumeration | http://www.toolswatch.org
(https://web.archive.org/web/20200417042744/http://www.toolswatch.org/)

scadastrangelove - SCADAPASS | http://www.scada.sl (https://web.archive.org/web/20200417042744/http://www.scada.sl/)

hackers-arise | https://www.hackers-arise.com (https://web.archive.org/web/20200417042744/https://www.hackers-arise.com/)

CRITIFENCE Critical Infrastructure and SCADA-ICS Cyber Threats Research Group

ABOUT CRITIFENCE®

CRITIFENCE® provides unique Cyber Security solutions designed for Critical Infrastructure, SCADA and Industrial Control Systems which allow to monitor and control OT

network easily and totally passively.

OUR VISION

Our vision is a secure and survivable cyber defense methodology of physical processes in Critical Infrastructures, SCADA and Industrial Control Systems.

- Eran Goldstein, CEO

KEEP CONNECTED

 Follow us on LinkedIn (https://web.archive.org/web/20200417042744/https://www.linkedin.com/company/10684086/)

 Like us on Facebook (https://web.archive.org/web/20200417042744/https://www.facebook.com/critifence)

 Follow us on GitHub (https://web.archive.org/web/20200417042744/https://github.com/CRITIFENCE)

CONTACT INFORMATION
https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 19/20
28/9/21 11:53 CRITIFENCE®
 CRITIFENCE Technologies Ltd.
2 Shenkar Street,
Herzliya, 4672502, Israel.

 +972 (77) 431 6382

 info@critifence.com (https://web.archive.org/web/20200417042744/mailto:info@critifence.com)

© 2017-2018 CRITIFENCE Technologies Ltd. All Rights Reserved

https://web.archive.org/web/20200417042744/http://www.critifence.com/default-password-database/ 20/20