("admin/admin" or similar). If these aren't changed, an opponent can literally only log in. The particular Mirai botnet inside 2016 famously attacked thousands of IoT devices by simply trying a listing of default passwords for gadgets like routers and cameras, since consumers rarely changed them. - Directory record enabled on the net server, exposing all files if no index page is present. This may reveal sensitive data files. -