The most commonly exposed device has been discontinued and vulnerable for a decade, new research found.