beroNet VoIP Gateways prior to 3.0.16 have a PHP script that allows downloading arbitrary files, including ones with credentials.
beronet voice_over_internet_protocol_gateways_firmware