A Firewall That Runs a Web Server Is Still a Web Server

Why an appliance web stack belongs in the attack-surface review, using the mod_md reverse shell in CL-STA-0954 as the case.