OT-HMI-DEFAULTSInitial Access

HMI Default Credentials

Wonderware / iFix / Ignition / Movicon HMIs left with vendor-default credentials reachable from the corporate LAN.

§ Where this technique fits

OT-HMI-DEFAULTS is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

HMI default credentials → operations disruption
Wonderware / iFix HMI exposed to the corporate network with vendor-default credentials. Operators see attacker-controlled values + commands sent to PLCs through legit channels.
step 2 / 5

§ What commonly comes next

01
Valid Accounts
T1078 · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

HMI default credentials → operations disruption

§ What commonly comes next