A persistent backdoor account is an unauthorized account left on a system so an attacker can keep access even after the main password is changed. It may be a hidden admin user, a second management login, or a vendor feature abused to create durable access.
This matters because password resets only help if they remove every path into the device. On internet-exposed systems such as IP cameras, a backdoor account can survive routine remediation and let an intruder return later, change settings, or use the device as a foothold. Defenders should inventory all accounts, review logs, disable unused remote-management features, update firmware, and, if compromise is suspected, perform a full reset or rebuild rather than only rotating the primary password.