How old is openssh within N900?

There are known exploits for older version of OpenSSH which don't require username/password knowledge.

TSL/SSL may be breached through redirections, especially if the logon page is loaded through basic http without SSL.

Don't use unencrypted login pages.

Basically, since the software running inside N900 is relatively old and therefore very well known to the attackers, you may have additional holes.