Hardening VICIdial: AMI Users, MySQL Accounts and Default Web Paths
Every stock VICIdial install ships with the same Asterisk Manager credentials, the same MySQL users, and the same web paths. They are documented publicly, which means they are in every scanner's wordl