Read the docs

FatPipe

Records6All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

FatPipe records in CISA KEV
TI-2021-09218 FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit Priority CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records
Ipvpn Firmware 6 records CRITICAL Mpvpn Firmware 6 records CRITICAL Warp Firmware 6 records CRITICAL

Records

6 records in Mpvpn Firmware · all components

TI-2021-09218 CVE-2021-27860 · GHSA-hfgw-xgjr-v384

Arbitrary file upload vulnerability in FatPipe software

Priority CRITICAL 100KEV

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.3968 Published 2021-12-08 Fixed in 10.1.2r60p92, 10.2.2r44p1 CWE-434
TI-2021-09214 CVE-2021-27856 · GHSA-8235-wx5q-8wrv

FatPipe software administrative account with no password

Priority MEDIUM 50

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05469 Published 2021-12-15 Fixed in 10.1.2r60p91, 10.2.2r42
TI-2021-09217 CVE-2021-27859 · GHSA-fr6w-vm34-xj98

Missing authorization vulnerability in FatPipe software

Priority MEDIUM 41

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows an authenticated, remote attacker with read-only privil…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01668 Published 2021-12-15 Fixed in 10.1.2r60p91, 10.2.2r42 CWE-862
TI-2021-09213 CVE-2021-27855 · GHSA-53hg-58mg-7j38

FatPipe software allows privilege escalation

Priority MEDIUM 41

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves administrative privileges.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01657 Published 2021-12-15 Fixed in 10.1.2r60p91, 10.2.2r42 CWE-862
TI-2021-09215 CVE-2021-27857 · GHSA-wgcg-wpg9-jq43

FatPipe software allows unauthenticated configuration download

Priority LOW 37

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, unauthenticated attacker to download a config…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01853 Published 2021-12-15 Fixed in 10.1.2r60p91, 10.2.2r42 CWE-862
TI-2021-09216 CVE-2021-27858 · GHSA-wv8m-chcw-6w78

Missing authorization vulnerability in FatPipe software

Priority LOW 29

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote attacker to access at least the URL "/fpui/jsp…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02776 Published 2021-12-15 Fixed in 10.1.2r60p91, 10.2.2r42 CWE-862
Open these records in search →