Default passwords
The password the vendor shipped. Fine for unboxing. Malpractice if it is still there at go-live.
Default passwords exist so a device can be set up or factory-reset. They are public by design. Leaving them on cameras, printers, firewalls, and IoT is how botnets recruit Australian small business overnight.
Change before the device touches a network you care about. Unique per device, in the password manager, MFA where the admin path supports it. Scan for them. Do not assume last year's project did.
Fact source: ASD's ACSC glossary.