I guess my big question here is why these endpoints were exposed to the Internet in the first place. I thought pretty much everyone these days put all their infrastructure in a private IP range behind a NAT firewall. I can't imagine throwing critical infrastructure up naked onto the Internet, whether I knew of a specific security issue with the firmware or not.