Upon completion of the testing one of the engineers at the city was actually quite relieved that we discovered what we did. He told us that he had made an attempt to contact the vendor with some concerns about an unintentional bridging of the cellular interface with the internal LAN interface. The vendor support team basically told him it was “impossible” and that he must be mistaken. We were unable to get a complete story on exactly what caused the misconfiguration but after some post testing analysis we discovered that the firmware versions differed among devices. The one we penetrated.