What is a default credential?
A default credential is the username and password a product ships with out of the box, meant to let an installer log in the first time. Because the same pair is identical across every unit and is printed in manuals anyone can download, it is a credential the whole world already knows. Left in place after deployment, it is one of the easiest ways into a device or application, requiring no exploit at all.
Why it is such a common weakness
Defaults are everywhere: network gear with admin and admin or admin and password, routers and cameras, databases with a blank administrator password, management consoles, printer web panels, and SNMP community strings set to public. Attackers keep lists of thousands of these by vendor and model and scan the internet for devices that still accept them. The weakness is purely one of configuration, so it sits entirely within the owner's control, which is also why the exam treats it as a vulnerability rather than a software flaw.
A real example
The Mirai botnet in 2016 scanned the internet for cameras, recorders and routers with remote administration open and tried a short list of factory username and password pairs. Enormous numbers of devices accepted the passwords they shipped with and were conscripted into attacks, and one of its floods disrupted the DNS provider Dyn in October 2016, leaving many popular websites unreachable for parts of the day. No software flaw was exploited; logging in with the factory credentials was enough.
How to defend against it
Change or disable every default account before a device or application joins the network, as a step on the deployment checklist. Give each device a unique credential stored in a password vault rather than a shared one, disable or rename built-in accounts where possible, and run credentialed scans that specifically test for known default logins. Restricting access to the management interface helps contain the risk, but it does not replace changing the password. Some jurisdictions now require consumer devices to ship without a universal default password at all.
Default credentials on the CompTIA Security+ exam
Default credentials are a vulnerability type under SY0-801 objective 2.4, which asks you to recognize the kinds of weaknesses organizations carry. The scenario clue is an attacker logging in with a vendor's documented username and password, or many identical devices falling at once with no exploit. The best answer changes the credentials during deployment; moving the service to another port or merely restricting access is weaker.