All vulnerabilities
CVE-2021-27860

FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit

FatPipe WARP, IPVPN, and MPVPN software
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 10 Jan 2022CISA KEV
Exploit odds (EPSS)39.7%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.1.2r60p92Also 10.2.2r44p1CVE List
Federal deadline24 Jan 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 8 Dec 2021, 16:15 UTCPublishedCVE List
  2. 10 Jan 2022Added to CISA KEVCISA KEV

Description

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.

Text from CVE List

Affected versions 6

  • WARPaffected: 10.1 before 10.1.2r60p92CVE List
  • WARPaffected: 10.2 before 10.2.2r44p1CVE List
  • IPVPNaffected: 10.1 before 10.1.2r60p92CVE List
  • IPVPNaffected: 10.2 before 10.2.2r44p1CVE List
  • MPVPNaffected: 10.1 before 10.1.2r60p92CVE List
  • MPVPNaffected: 10.2 before 10.2.2r44p1CVE List

References 4