The flaw is probably the users not changing default passwords, not using strong passwords and not using strong encryption.