This library serves unauthenticated SOAP on the LAN by design (device-level trust boundary is the network; see the firmware family's contract api v1.9). Report vulnerabilities via the repo's private security advisories.