Weak or default passwords remain the biggest vulnerability in IoT devices, enabling large-scale cyber attacks.