Dataphone A920 version 2025.07.161103 has an incorrect access control vulnerability that exposes a service on port 8888 by default on the local network without requiring authentication. This allows unauthenticated attackers to interact with the device via a TCP socket. Additionally, sending an HTTP request to this service triggers an error response that reveals internal functionality, headers identifying Paytef dataphone packets, and the device's build version.