US pharmacy chain's IT and auditors clashed over 'password' on Cisco firewall

Pentester Dahvid Schloss found the admin password on a major US pharmacy chain's edge Cisco firewall was literally 'password'. Auditors demanded an immediate fix while IT dismissed it as low priority; the call dragged on over an hour because a 'high finding' would void the IT division's bonuses.

• Edge Cisco firewall's enable password was set to 'password'
• Hash used reversible Cisco IOS type 7 encoding with a public key
• Auditors wanted an urgent fix; IT argued it was only medium risk
• A 'high finding' would have stripped the IT team of bonuses