According to Security testing criteria,
Default passwords are required to be changed at first logon
Since the admin password is stored in config file in system in plain text.