Backup server admin interface reachable from the customer network

During the penetration test the tester reached the administration interface of the backup server from a laptop on the customer network. Only a password protected it. An attacker on that network could therefore try to guess the password and, once in, delete or read customer backups.