I should add: I have choosen severity grave due to the potential of code execution as root if the service is enabled. Am I right that in *any* version present in Debian the web interface is started?
If so we might lower the severity. Regards, Salvatore