CVE-2021-27860

CVE-2021-27860 is a critical-severity (CVSS 9.8) vulnerability in FatPipe WARP, IPVPN, and MPVPN software. CISA added it to the Known Exploited Vulnerabilities catalog on January 10, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by January 24, 2022. CISA does not currently list it as used in ransomware campaigns.

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• https://www.fatpipeinc.com/support/cve-list.php
• https://www.ic3.gov/Media/News/2021/211117-2.pdf
• https://www.fatpipeinc.com/support/cve-list.php
• https://www.ic3.gov/Media/News/2021/211117-2.pdf
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27860