Dave,

Yes, unfortunately, someone can hack in using default passwords. I had that happen once. ;(

Under "System Data" --> "Station Web Authorization" you can change the call-forwarding (or any other setting) to N/A so that the user cannot change that particular setting. Just make sure that the Stations are programmed for Level 2 or Level 3.

You can also change the "Web Admin Login Failure count to block" under system attributes. This will slow a hacker down.

If you're going to forward port 80 from the outside, which is always desirable, then the best practice is to utilize the built-in "Access Control List" (System Data) to block everything but your office IP and the internal LAN, and whatever else you may need (SMTP, NTP, etc). Just a warning, if you don't allow the local LAN access, you won't be able to get back into programming.

Gainesville Telephone Systems
Jacksonville Telephone Systems