This vulnerability involves the WebUI template database shipping with factory default passwords for all five account types stored in cleartext. These default passwords are identical across devices and were not changed on the tested unit, posing a significant security risk.