Virgin Super Hub 2 serious security bug – act now to close the hole

Which is the bigger router issue: a configuration backup flaw or weak credentials?