InformationSets the privilege level for the user.
Default device configuration does not require strong user authentication potentially enabling unfettered access to an attacker that is able to reach the device. Creating a local account with privilege level 1 permissions only allows the local user to access the device with EXEC-level permissions and will be unable to modify the device without using the enable password. In addition, require the use of an encrypted password as well (see Section 18.104.22.168 - Require Encrypted User Passwords).
Organizations should create policies requiring all local accounts with 'privilege level 1' with encrypted passwords to reduce the risk of unauthorized access. Default configuration settings do not provide strong user authentication to the device.
SolutionSet the local user to privilege level 1.
hostname(config)#username <LOCAL_USERNAME> privilege 1