OK NiLuJe Thanks a lot...
If I can find some more time, I'll try wireshark to see if a username/password is "protecting" the http://127.0.0.1:9101/change<whatever command>.
But I do not feel like it will magically help...
I guess this is, again, the result of a deep sense of "customer satisfaction" (as far as the said customer respectfully pays and pays)