Security experts at Trustwave have discovered a hidden backdoor in Internet of Things devices manufactured by the Chinese firm DblTek. Backdoored devices are produced by the VoIP firm DBltek, the researchers speculate the backdoor was introduced for debugging purposes. The Telnet interface of the GoIP has an undocumented user, namely dbladm which provides root level shell access on the device. The account is not protected by a password, instead, it is protected by the proprietary challenge-response authentication scheme.”]
Source: http://securityaffairs.co/wordpress/56833/iot/dbltek-iot-device-flaw.html