By default it's possible to access IOS Web interface without authentication with highest access security level.
vulners.com/securityvulns/securityvulns:doc:13498