("admin/admin" or similar). If these aren't changed, an opponent can literally only log in. The particular Mirai botnet in 2016 famously contaminated hundreds of thousands of IoT devices by just trying a directory of arrears passwords for devices like routers in addition to cameras, since consumers rarely changed these people. - Directory list enabled over a web server, exposi