Unauthenticated UPS control via forced browsing

Missing authentication in ViewPower through 1.04-21353 and Netguard before 1.04-23292 allows remote attackers to alter UPS settings. Administrative web handlers such as /ViewPower/login/updatePassword process direct POST requests without verifying a session, exposing password, configuration, device-control, and shutdown-command settings. No credentials or user interaction are required; a network-reachable attacker can reset the administrator password, inspect or change configuration, enumerate UPS devices, cut connected power, or plant a command for later execution during UPS shutdown.