Mirai scanned the internet for IoT devices and logged in using a list of 62 common default usernames and passwords, according to a CISA alert from October 2016. Infected routers, cameras and video recorders joined a botnet used for large DDoS attacks. Changing the factory password was the main defence, and still is.
How it infected devices
CISA's alert says Mirai continuously scans for vulnerable IoT devices and tries a short list of default credentials. Devices that kept their factory settings were exposed. A later Mirai derived variant also scanned TCP port 7547 and exploited a SOAP flaw in broadband routers that leave that port open.
No vulnerability in the usual sense was needed for most devices. The weakness was configuration: a known password, reachable from the internet.
What it did
Infected devices became part of a botnet used for distributed denial of service attacks. The alert cites attacks on the Krebs on Security blog exceeding 620 Gbps and on the French host OVH of at least 1.1 Tbps. Affected devices were mainly home routers, network cameras and digital video recorders. The source code was published in late September 2016, which raised the risk of more botnets built from it.
Removal and prevention, per CISA
Removal steps:
- Disconnect the device from the network.
- Reboot it while offline. The alert says Mirai resides in memory, so a reboot clears it.
- Change the default password to a strong one before reconnecting.
Reconnecting before the password change can lead to quick reinfection, because the scanners are still out there.
Prevention, per CISA:
- Change all default passwords.
- Apply security patches promptly.
- Disable UPnP on routers unless necessary.
- Buy from vendors with a good security reputation.
- Monitor ports 23 and 2323 over TCP, and 48101, for suspicious traffic.
- Harden networks against DDoS.
Lessons for product teams
If you build connected devices, the fixes are in your hands.
- Do not ship one shared default password. Generate a unique credential per device, or force a change at first setup.
- Close remote management ports by default.
- Provide an update path and make it easy to use.
- Publish a way to report vulnerabilities.
Why default passwords persist
Default credentials survive because they are convenient. A shared factory login makes support easier and setup faster for the vendor, and many owners never open the admin page after plugging a device in. Devices also stay in service for years, so one bad shipment keeps feeding attackers long after the vendor changes its practice.
Home users are not the only owners. Offices, shops and factories run cameras, recorders and routers that nobody inventories, and those are the devices that never get a password change.
Lessons for buyers and operators
Keep an inventory of every networked device, including cameras and printers. Put them on a separate network segment from sensitive systems. Review which ones accept inbound connections from the internet. Safeguard's asset discovery helps with the inventory part of that list. For other physical and connected device risks, see our area guides on OT asset inventory.
Quick check
Did Mirai need a software vulnerability?
Mostly it used default credentials. A later variant also exploited a SOAP flaw on port 7547.
Does a reboot remove Mirai?
Per CISA, yes, since it resides in memory. Change the password first or it can return.
Sources
Last reviewed: 19 October 2026.
