I take it your webservers have no csrf protection, run on unencrypted http, pass passwords in plaintext over basic auth, run with root-level permissions on hardware, and haven't been updated ever.