High severity · published Dec 15, 2021
CVE-2021-27857
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote,…
7.5
CVSS
1.9%
EPSS
No
On KEV
Description
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, unauthenticated attacker to download a configuration archive. The attacker needs to know or correctly guess the hostname of the target system since the hostname is used as part of the configuration archive file name. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA003.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ipvpn Firmware · Fatpipeinc
5.2.0; 6.1.2; 6.1.2; 6.1.2; 7.1.2; 9.1.2; +30 more · source: NVD
MF
Mpvpn Firmware · Fatpipeinc
5.2.0; 6.1.2; 6.1.2; 6.1.2; 7.1.2; 9.1.2; +30 more · source: NVD
WF
Warp Firmware · Fatpipeinc
5.2.0; 6.1.2; 6.1.2; 6.1.2; 7.1.2; 9.1.2; +30 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27857
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27857
Vendor Advisory
https://www.fatpipeinc.com/support/cve-list.php
Third Party Advisory
https://www.zeroscience.mk/codes/fatpipe_configdl.txt
Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5683.php
More from Ipvpn Firmware
8.8
CVE-2021-27860
Arbitrary file upload vulnerability in FatPipe software
9.8
CVE-2021-27856
FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password
8.8
CVE-2021-27859
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows an…
8.8
CVE-2021-27855
FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves…
5.3
CVE-2021-27858
A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote…