Cisco DPC3941B is publicly accessable on the internet despite bridge mode

I discovered an odd issue with a comcast business connection in San Fransisco.  They have a Comcast provided Cisco DPC3941B currently configured for bridge mode that is receiving a publicly reachable 24.X.X.X address.  They are also recieving a 50.X.X.X address for the single device plugged into this router.

Anyone who scans/stumbles across the 24.X.X.X address is able to log in using the standard comcast "cusadmin" account and completely control the router.  Is this expected behavior?