During a security audit, a penetration tester discovers that a batch of deployed IoT cameras all authenticate management access using the same username and password, which are embedded directly in the firmware image and cannot be changed by the customer. Which vulnerability category best describes this finding?