A default configuration allows full admin access to unauthenticated attackers.
Source: Threadpost