CERT has issues Vulnerability Note VU#906576 on Securifi Almond routers.
Excerpt of VU#906576:
CWE-330: Use of Insufficiently Random Values – CVE-2015-2914
CWE-319: Cleartext Transmission of Sensitive Information
CWE-255: Credentials Management – CVE-2015-2915
CWE-352: Cross-Site Request Forgery (CSRF) – CVE-2015-2916
CWE-20: Improper Input Validation – CVE-2015-2917
Securifi Almond, firmware version AL1-R200-L302-W33 and earlier, and Securifi Almond 2015, firmware version AL2-R088 and earlier, contain multiple vulnerabilities. A remote, unauthenticated attacker may be able to spoof DNS responses to cause Almond LAN clients to contact attacker-controlled hosts or induce an authenticated user into making an unintentional request to the web server that will be treated as an authentic request. Securifi has released firmware versions to address these vulnerabilities. Almond users should upgrade to AL1-R201EXP10-L304-W34 or later. Almond 2015 users should upgrade to AL2-R088M or later. Note that the firmware updates mitigate the CSRF and clickjacking vulnerabilities by disabling the web management interface. Users may still enable web management from the Almond touch screen controls, but doing so will render their devices vulnerable. The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround.