Researchers find that a vendor's firmware image contains the same built-in administrative password on every unit shipped, and the account cannot be disabled from the management interface. A customer proposes enforcing a strong local password policy at each site. Why is that insufficient?
Select an answer to reveal the explanation.
Short Explanation
It's like a builder who keyed every house in the neighborhood to the same master key and welded the lock shut. You can change your own door code all day, but that master key still works. Hardcoded credentials live in the firmware, so only the vendor's fix truly removes them.
Full Explanation
Hardcoded credentials are authentication secrets embedded in software or firmware, identical across every installation and outside the administrator's control. Because the account is compiled into the image and cannot be disabled, an attacker who learns the password from one unit, a firmware download, or a public advisory can use it everywhere. A local password policy governs accounts that administrators create and change; it cannot alter a secret the firmware itself enforces. The real remediation is a vendor update that removes the credential, with compensating controls meanwhile: restrict management access to a dedicated network, filter management ports, and monitor for logins. The claim that password policy never applies to local accounts is false, and it misplaces the problem, which is that this account is not governed by policy at all. Describing the flaw as a buffer overflow misclassifies it; the weakness is a known shared secret, not memory corruption. Stronger hashing is irrelevant because the attacker already knows the plaintext password; hashing protects stored secrets from disclosure, not a published one. Exam caveat: hardcoded credentials are a classic CVE category and often receive critical CVSS scores. Operational check: confirm the fixed firmware version from the vendor advisory, upgrade, and verify the account no longer authenticates.