> We are unsure of the particular exploit used in any given case, but most devices targeted, particularly in older versions, have known public exploits or default credentials that make compromise relatively straightforward.

Granted, this info is coming from Cisco, but it looks like no back door is necessary in this case.