"BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to val_users.php3."
https://cve.circl.lu/cve/CVE-2020-10248 …