Heck, who needs passwords when you got this?

> There's also a documented authentication bypass: sending a POST request to /xml.cgi can bypass the login entirely.