Nice response from the company, pity they made that many mistakes. Please note that this is not exceptional at all. APIs and underwater calls from web pages and apps to access some functionality are rife with bugs and security holes, the stuff you find makes you hair stand on end. Also, the SCADA world (which this product is a part of) is not exactly known for great focus on security, if there is security at all it's surprising, more likely it is just obscurity. These systems are used to remotely control building facilities such as heating, lighting, air-conditioning and all kinds of alarms.
One system I'm familiar with (I won't name any brands because this is a legacy system and imo impossible to fix without a total replacement) is based on the BASIC stamp and will accept UDP packets where every bit in the payload is the status of an output and will respond with a UDP packet detailing the inputs. Guess what happens if you start hitting those ports with payloads of 'all 1' and 'all 0' alternating every second or so...