A critical vulnerability has been identified in Voltronic Power ViewPower and PowerShield Netguard software, which allows an unauthenticated remote attacker to gain administrative control over the system's web interface. Successful exploitation could allow an attacker to alter power management configurations, potentially leading to widespread power disruption for connected critical infrastructure, data loss, and equipment damage. Due to the high severity and potential for significant operational impact, immediate remediation is strongly advised.

The vulnerability is a missing authentication check on a critical function within the web interface of the affected software. A remote attacker with network access to the device's management portal can send a specially crafted HTTP request to modify system configurations without providing any credentials. This allows an unauthenticated user to perform administrative actions, such as changing UPS settings, scheduling shutdowns, or altering network parameters, effectively granting them full control over the power management system.

This vulnerability is rated as critical severity with a CVSS score of 9.8. Exploitation could have a severe and direct impact on business operations. An attacker could maliciously shut down power to critical IT infrastructure, including servers, storage, and network devices, leading to major service outages, data corruption, and significant financial loss. Furthermore, by manipulating power settings, an attacker could potentially cause physical damage to sensitive equipment. This vulnerability poses a direct threat to business continuity, operational stability, and the physical security of IT assets.

Immediate Action: Immediately update all instances of affected software to the latest patched version as recommended by the vendor.

• Update Voltronic Power ViewPower to a version later than 1.04-21353.
• Update PowerShield Netguard to version 1.04-23292 or newer.

Proactive Monitoring:

• Log Analysis: Review web server access logs on affected devices for unusual or unauthorized POST requests to configuration-related endpoints, especially from unknown IP addresses.
• Configuration Audits: Implement regular monitoring for any unauthorized or unexpected changes to the UPS and power management configurations.
• Network Traffic: Monitor network traffic to and from the management interfaces of these devices for anomalous patterns or connections originating from untrusted network segments.

Compensating Controls: If immediate patching is not feasible, implement the following controls to mitigate risk:

• Network Segmentation: Restrict access to the device's web management interface using a firewall or network access control lists (ACLs). Only allow access from a dedicated, trusted management network or specific administrative IP addresses.
• Disable External Access: Ensure the management interface is not exposed to the public internet. If remote access is required, enforce the use of a secure VPN with multi-factor authentication.

Public Exploit Available: true

Given the critical CVSS score of 9.8, the ability for unauthenticated remote exploitation, and the availability of public exploit code, this vulnerability represents a severe and immediate threat. We strongly recommend that organizations prioritize the immediate patching of all affected Voltronic Power and PowerShield systems. If patching cannot be performed immediately, the compensating controls, particularly network segmentation to isolate the management interface, must be implemented without delay to reduce the attack surface. Although not currently listed on the CISA KEV catalog, the high risk profile warrants treating this vulnerability with the highest urgency.