By default, APC installs with a default password on the integrated HTTP server (TCP Port 3052). The 'apc' account has a password of 'apc' which is publicly known and documented. This allows attackers to trivially access the program or system.
Immediately after installation, change all default install passwords to unique and secure passwords. When possible, change default accounts to custom names as well.