Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.
johnsoncontrols exacqvision web service