Phew, nextcloud and freshrss both have updates to resolve the vulnerability. Furiously logs in to update

I suspect these controllers were mostly being used for telemetry (getting notified if they lose power), not remote control. But they were still vulnerable to zero-days if not updated. Kind of the same story as all the other IoT stuff that has turned out to be vulnerable.