Okay, patches are out since some month, but not installed. The devices are directly accessible through the web. There are default passwords.

I think this is the only way to explain supermarkets how IT security works. What a shame about the lovely food :(