The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Send an enquiry, or call or email us to get started.