Some of these items seem like they need more analysis, and that the report was rushed. We agree as a community that hard coded default passwords are bad when un

Some of these items seem like they need more analysis, and that the report was rushed. We agree as a community that hard coded default passwords are bad when unchanged, but that implies that the device doesn't require them to be changed on first boot. Basic setup processes often require these credentials to change after the first provision. I would expect a report which produces claims about such comprehensive backdooring and negligence to at least demonstrate how that behavior would play out in the real world. It seems much more like they did static analysis of the binaries, identified any strings with default passwords, and then reported on them. That's okay to do, but you can't conclude that's a problem until you confirm shoddy behavior after provisioning and deployment in practice.