A municipal water treatment facility has digitized its critical valve control interface to allow engineers to manage water flow rates remotely. The current system authenticates utility workers using only a unique username and a memorised alphanumeric passcode.

Identify two distinct security vulnerabilities or limitations of relying solely on this single-factor passcode-based authentication to protect this high-risk infrastructure.