As I said elsewhere, I agree, the web server shouldn't be enabled with a default password.