Organisations have to be careful of how they dispose of any IT equipment, not just their PC’s and hard disks, anything with writeable flash memory that can store settings can be a security threat.
In this ITPro article, “Second-hand VPN leads to security breach at council” Kirklees Council were caught out by their disposal policy and a Cisco VPN device was bought on EBay for £1 which when turned on it logged into the council’s servers, giving access to the network as though they had plugged in a cable inside the data centre.
Kirklees council commented that there were “multiple layers of security” needed to access data, but this is a big first step of taking those layers down.
That factory reset switch is your friend.