The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Missing Authentication for Critical Functionality The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.