yeah, that should get whether it’s been used; I was more interested in whether someone has enabled remote management since the vuln seems to be usable over it.