Web administration interface is available from external network even if turned off administratively.
vulners.com/securityvulns/securityvulns:doc:6275