CVE-2021-27860 FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
Remote unauthenticated attackers can upload arbitrary files to any filesystem location in FatPipe WARP, IPVPN, and MPVPN software.
- Exploited in the wild
- Since 10 Jan 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27860?
CVE-2021-27860 is a critical vulnerability in FatPipe IPVPN, published on 8 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.
Weakness: CWE-434
Which versions are affected by CVE-2021-27860?
It affects 3 products.
Products include Fatpipeinc Ipvpn Firmware, Fatpipeinc Mpvpn Firmware, Fatpipeinc Warp Firmware.
How do I fix CVE-2021-27860?
No fix has been published for CVE-2021-27860 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Jan 2022.
Is CVE-2021-27860 being exploited?
Yes. Attackers have exploited CVE-2021-27860 in the wild since at least 10 Jan 2022.
Other vulnerabilities in FatPipe IPVPN
- CVE-2021-27856 FatPipe software administrative account with no password
- CVE-2021-27855 FatPipe software allows privilege escalation
- CVE-2021-27859 Missing authorization vulnerability in FatPipe software
- CVE-2021-27857 FatPipe software allows unauthenticated configuration download
- CVE-2021-27858 Missing authorization vulnerability in FatPipe software
Sources
Also known as GHSA-hfgw-xgjr-v384.