In my opinion things like this would be solved by having a management node or management software that the devices are allowed to connect to with mutual auth an

In my opinion things like this would be solved by having a management node or management software that the devices are allowed to connect to with mutual auth and a pairing process initiated/completed at each end. No inbound connections allowed at all to the UPS. Not a single listening socket. Input the IP of the management node into the UPS and then log into the management node to complete the pairing process which should require the serial number of the device and a management key. Given the crappy keypads on most of these units optionally also allow a USB with preloaded configurations, power thresholds, battery cuttoff, alert levels, ATS settings, voltage thresholds, management IP, etc... UPS verifies encryption key on USB and decrypts configuration that was written by the management node, loads and runs it, LED/LCD display says "Conf vers nnxxxx loaded. Have a good day!"