Critical severity · published Dec 15, 2021
CVE-2021-27856
FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password
9.8
CVSS
5.5%
EPSS
No
On KEV
Description
FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ipvpn Firmware · Fatpipeinc
5.2.0; 6.1.2; 6.1.2; 6.1.2; 7.1.2; 9.1.2; +30 more · source: NVD
MF
Mpvpn Firmware · Fatpipeinc
5.2.0; 6.1.2; 6.1.2; 6.1.2; 7.1.2; 9.1.2; +30 more · source: NVD
WF
Warp Firmware · Fatpipeinc
5.2.0; 6.1.2; 6.1.2; 6.1.2; 7.1.2; 9.1.2; +30 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27856
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27856
Vendor Advisory
https://www.fatpipeinc.com/support/cve-list.php
Third Party Advisory
https://www.zeroscience.mk/codes/fatpipe_backdoor.txt
Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5684.php
More from Ipvpn Firmware
8.8
CVE-2021-27860
Arbitrary file upload vulnerability in FatPipe software
8.8
CVE-2021-27859
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows an…
8.8
CVE-2021-27855
FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves…
7.5
CVE-2021-27857
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote,…
5.3
CVE-2021-27858
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote…