Vulnerabilities

An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.

An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.

An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.