Password protection enforced at the client seems to be Siemens way of doing security. I discovered this flaw in their heat pump controller when I was working on

Password protection enforced at the client seems to be Siemens way of doing security. I discovered this flaw in their heat pump controller when I was working on monitoring system for the pump. I had to disassemble their Java applet that was used to show temperature information and configure the controller to replicate the protocol used. Password protection? Client reads the password from the controller and compares it to user-provided string. If there is a match, client continues to read/write data, if not, client asks for password again. No password verification on controller at all.