ah good, so it is nothing specific, just guesswork based on a very superficial first glance -- it seems they believe FTP and TFTP are enabled by default, which is absolutely not the case (for good reason!). They did have one good point, regarding the first CVE (the path traversal), which is [...]