i am not going to point fingers, but there is one vendor that had or maybe still has issue, that allowed you to get to management interface of entire organization as administrator if you knew serial number of one of the devices deployed.

i by accident got into admin account of rather large organization with hundreds of devices active

this vendor didn't have proper way that allowed to disclose this issue in a anonymous fashion.