This vulnerability involves a web server that fails to enforce authentication checks on POST or PUT requests. An unauthenticated attacker can exploit this flaw to reboot the device. Additionally, by brute-forcing the configuration identifier (configid), the attacker can set the service password and modify any configuration settings.