download.rsp on ShenZhen Anni "5 in 1 XVR" devices allows remote malicious users to download the configuration (without a login) to discover the password.
annigroup 5_in_1_xvr_firmware -