Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.
CWE-521, CWE-521