STIGQter STIGQter: STIG Summary: Network Device Management Security Requirements Guide Version: 5 Release: 5 Benchmark Date: 01 Jul 2026:

The network device must be configured to verify, when users create or update passwords, the passwords are not found on the list of commonly used, expected, or compromised passwords in IA-5 (1) (a) for password-based authentication.

DISA Rule

SV-264299r1067634_rule

Vulnerability Number

V-264299

Group Title

SRG-APP-000845

Rule Version

SRG-APP-000845-NDM-000220

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the network device to verify when users create or update passwords; to ensure the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a); a change to any default manufacturer passwords.

Check Contents

Verify the network device is configured to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a), including default manufacturer passwords.

If the network device is not configured to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a), this is a finding.

Vulnerability Number

V-264299

Documentable

False

Rule Version

SRG-APP-000845-NDM-000220

Severity Override Guidance

Verify the network device is configured to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a), including default manufacturer passwords.

If the network device is not configured to verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a), this is a finding.

Check Content Reference

M

Target Key

2890