An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.
CWE-522