In a world of ever increasing numbers of internet connected devices people are having more and more of their appliances exposed to the outside world: cameras, fridges, thermostats etc.
Many of these are left with the default passwords enabled and are easily searchable on websites such as Shodan.
My question is this, is it legal to access such a device for the sole purpose of determining if the default credentials have been used so that you can alert the owner of this security vulnerability?
For instance: by default, a Raspberry Pi has SSH enabled with the login
pi and password
I'm particularly interested in the take on this in the UK and any precedents.