Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
CWE-15