Hacked VPN100

Hi,

We had the same problem with USG Flex 500 V5.37 - few times someone logged to device from WAN using built in admin and created another user with SSL VPN access, then he got to local network and logged via RDP to serwer using credentials saved in USG Flex for LDAP authentication. Could he retrieve that domain password from the device memory?

And what with built in admin? Is it some backdoor or I should worry that our passwords leaked somehow? There was no failed attempts in logs, just first successfull logon.