ETSI EN 303 645 Default passwords for consumer IoT products

Provision 5.1-1 applies where passwords are used. In any state other than factory default, each consumer IoT device password must be unique per device or defined by the user. That means a shipped value such as a universal admin password cannot be the operational password after setup.

The standard gives several acceptable patterns: unique pre-installed passwords, requiring the user to choose a password during initialization, or avoiding passwords by using another authentication method. The answer should be scoped to each authentication mechanism, not just to the product as a whole.

Provision 5.1-2 applies when pre-installed unique per-device passwords are used. The generation mechanism must reduce the risk of automated attacks against a class or type of device, so the evidence has to cover the generation method, not only a sample label or onboarding screenshot.

ETSI gives examples of weak patterns to avoid: incremental counters, common strings, and passwords obviously related to public information such as MAC addresses or Wi-Fi SSIDs. TS 103 701 turns that into conceptual checks on regularities, common patterns, relationship to public information, and appropriate complexity.

Default-password work is only one part of clause 5.1. If users can authenticate against the device, the device must provide a simple mechanism for the user or administrator to change the authentication value. If the device is not constrained, it must also have a mechanism that makes brute-force attacks on authentication mechanisms via network interfaces impracticable.

For an assessment, TS 103 701 expects the supplier organization to complete ICS and IXIT information so the test laboratory can derive a test plan. Incomplete IXIT information can lead to an inconclusive test result because the test case cannot be properly executed.