Vulnerability · Published Dec 15, 2021 · Assigned by certcc

CVE-2021-27855FatPipe software allows privilege escalation

High 8.8

In plain English

A high-severity missing authorization in IPVPN from FatPipe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.7%top 23.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves administrative privileges. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA001.

Affected products (as reported)

Vendor	Product	Versions
FatPipe	WARP	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42
FatPipe	IPVPN	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42
FatPipe	MPVPN	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5685.php x_refsource_MISC
https://www.fatpipeinc.com/support/cve-list.php x_refsource_CONFIRM
https://www.zeroscience.mk/codes/fatpipe_privesc.txt x_refsource_MISC