CVE-2021-27860

CVE-2021-27860 affects FatPipe WARP, IPVPN, and MPVPN web management interfaces. An unauthenticated remote attacker can upload arbitrary files to any location on the filesystem on affected devices running versions < 10.1.2r60p92 or

CVE-2021-27858

FatPipe WARP/IPVPN/MPVPN contains a missing authorization vulnerability (CVE-2021-27858) in the web management interface, affecting versions prior to 10.1.2r60p91 and 10.2.2r42. The issue allows an unauthenticated, remote attacker to access at least the URL /fpui/jsp/index.jsp, with impact descri...

CVE-2021-27855

CVE-2021-27855 affects FatPipe WARP/IPVPN/MPVPN software prior to 10.1.2r60p91 and 10.2.2r42. The vulnerability allows a remote, authenticated user with read-only privileges to elevate to administrative privileges via a privileged action (HTTP/JSON parameter manipulation). Affected versions inclu...

CVE-2021-27856

CVE-2021-27856 affects FatPipe WARP/IPVPN/MPVPN software prior to 10.1.2r60p91 and 10.2.2r42. A backdoor admin account named “cmuser” exists with no password, enabling unauthenticated administrative access and potential full device compromise. Connected sources consistently describe the issue as ...

CVE-2021-27859

CVE-2021-27859 (FatPipe WARP/IPVPN/MPVPN) is a missing authorization vulnerability in the web management interface that allows an authenticated, read-only user to create an administrative account. Affected versions are FatPipe software prior to 10.1.2r60p91 and 10.2.2 prior to r42; older FatPipe ...

CVE-2021-27857

CVE-2021-27857 describes a missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN. Before versions 10.1.2r60p91 and 10.2.2r42, remote unauthenticated attackers can download a configuration archive, with the hostname used as part of the file name. Old...