It's whatever you set it to in server.cfg. If it's not in there, then there's probably no password which I believe means no rcon available. So set one in the cfg, or use the actual console to set one (or make the change). 'rconpassword' is the cvar which you seek.