Rapiscan Default Password May 2026

Perform quarterly penetration tests that specifically check for default credentials. Many commercial scanning tools (Nessus, OpenVAS) have plugins to test Rapiscan default passwords.

Leaving a default password active on security screening equipment is not merely poor practice—it can violate multiple regulatory frameworks:

| Regulation | Requirement | Consequence of Default Password | |------------|-------------|--------------------------------| | TSA 1542.303 (Airport Security) | Access control to screening systems | Up to $10,000/day fine | | C-TPAT (Customs-Trade Partnership) | Secure IT systems for cargo scanners | Loss of trusted trader status | | GDPR (if scanning personal baggage) | Appropriate technical measures | 4% of global turnover | | ISA/IEC 62443 (Industrial Security) | No default credentials | Failed certification | rapiscan default password

In 2022, a regional airport in the Midwest was cited by the TSA after an inspection revealed the Rapiscan baggage scanner in the checked luggage area still had the factory admin:admin credentials active. The airport was given 30 days to remediate.

To understand the risk, visualize a typical airport baggage handling area. A Rapiscan 620 runs Windows XP (end-of-life since 2014). It has the default rapiscan/rapiscan credentials. This machine is not on the internet, but it is on the airport’s non-public IT network for sending scan images to a central server. Change or disable:

A: Most models have a physical jumper or button on the mainboard that resets credentials to factory defaults. This requires opening the chassis and usually voids the warranty if done improperly. Contact Rapiscan support.

For years, OT security relied on the assumption that these machines were "air-gapped" (not connected to the internet). The Rapiscan vulnerability shattered this illusion. Modern airport scanners are often networked for central monitoring, image storage, or remote diagnostics. Once a device is on the network, a hardcoded password becomes a gateway for lateral movement by attackers who have breached the network elsewhere. Create a dedicated service account with a strong

You do not need to be a master hacker. The information is surprisingly accessible: