CWE-420

When the internal flash is protected by blocking access on the Data Bus (DBUS), it can still be indirectly accessed through the Instruction Bus (IBUS).

DB server assumes that local clients have performed authentication, allowing attacker to directly connect to a process to load libraries and execute commands; a socket interface also exists (another alternate channel), so attack can be remote.

Product does not restrict access to underlying database, so attacker can bypass restrictions by directly querying the database.

User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.

FTP service can not be disabled even when other access controls would require it.