ZyXEL Prestige 642R and 642R-I routers do not filter the routers' Telnet and FTP ports on the external WAN interface from inside access, allowing someone on an internal computer to reconfigure the router, if the password is known.
https://exchange.xforce.ibmcloud.com/vulnerabilities/7146
http://www.securityfocus.com/bid/3346
http://www.securityfocus.com/archive/1/214971
http://www.securityfocus.com/archive/1/204439