What's the appliance? Most current consumer routers come with a backdoor called TR-069[0] that allows the ISP to provision and update the device. Recently other appliances than routers have started using the same protocol.
The session is initiated from the client, but if you can MITM it or compromise the provisioning server all bets are obviously off.
I have mixed feelings about TR-069, but don't see how devices can stay current without something like it.