In the first paper they claim there was a backdoor without providing any proof to the claims. The vendor responds saying that this is a feature that can be turn

In the first paper they claim there was a backdoor without providing any proof to the claims. The vendor responds saying that this is a feature that can be turned off. The researchers give nothing that can refute this and its likely that manufacturers clients can easily verify. The researchers then release a new paper with moderated backdoor claims that contradict themselves: "Ultimately, an attacker can extract the intellectual property (IP) from the device as well as make a number of changes to the firmware such as inserting new Trojans into its configuration." A vulnerability that allows one to 'insert' a trojan is not the same as a device or system 'with' a trojan. It's not snake-oil but the language, and insistence on this language still, is certainly FUD.