CVE-2021-27857: A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42…

PriorityP350high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

1.79%

75.7th percentile

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, unauthenticated attacker to download a configuration archive. The attacker needs to know or correctly guess the hostname of the target system since the hostname is used as part of the configuration archive file name. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA003.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
fatpipe	ipvpn	>= 10.1 < 10.1.2r60p91	10.1.2r60p91
fatpipe	ipvpn	>= 10.2 < 10.2.2r42	10.2.2r42
fatpipe	mpvpn	>= 10.1 < 10.1.2r60p91	10.1.2r60p91
fatpipe	mpvpn	>= 10.2 < 10.2.2r42	10.2.2r42
fatpipe	warp	>= 10.1 < 10.1.2r60p91	10.1.2r60p91
fatpipe	warp	>= 10.2 < 10.2.2r42	10.2.2r42
fatpipeinc	ipvpn_firmware	—	—
fatpipeinc	ipvpn_firmware	—	—
fatpipeinc	ipvpn_firmware	—	—
fatpipeinc	ipvpn_firmware	—	—
fatpipeinc	ipvpn_firmware	—	—
fatpipeinc	ipvpn_firmware	—	—
fatpipeinc	mpvpn_firmware	—	—
fatpipeinc	mpvpn_firmware	—	—
fatpipeinc	mpvpn_firmware	—	—
fatpipeinc	mpvpn_firmware	—	—
fatpipeinc	mpvpn_firmware	—	—
fatpipeinc	mpvpn_firmware	—	—
fatpipeinc	warp_firmware	—	—
fatpipeinc	warp_firmware	—	—
fatpipeinc	warp_firmware	—	—
fatpipeinc	warp_firmware	—	—
fatpipeinc	warp_firmware	—	—
fatpipeinc	warp_firmware	—	—

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.