The invention provides a weak-password scanning method and device. The method includes: acquiring to-be-checked terminals of the same type; randomly sampling the above-mentioned to-be-checked terminals of the same type according to the number of preset user-name and weak-password combinations to generate sampling samples of the to-be-checked terminals; scanning the sampling samples of the to-be-checked terminals through the preset user-name and weak-password combinations, using user-name and weak-password combinations of successful login to scan the to-be-checked terminals of the same type, and recording the number of to-be-checked terminals of successful login; and when the number of the to-be-checked terminals of successful login is greater than a predetermined threshold value, determining that a security problem of the to-be-checked terminal of the same type exists. According to the weak-password scanning method provided by the invention, terminal scanning efficiency is remarkably improved, broadband occupancy is reduced, remote scanning is used, and manual field inspection for the terminals is prevented.