The design of this system is grossly negligent, which IS a management problem. It does look like a web page. How is the page served? An internal secure setup on a private network? Is the browser ever updated? Is there javascript? The number of failure modes on this type of setup is unconstrained. How are updates tested? It appears to me that somebody just put something together without any design or validation process at all. This is fine in many settings, but not for critical public safety infrastructure.