Vulnerability · Published Dec 15, 2021 · Assigned by certcc

CVE-2021-27856FatPipe software administrative account with no password

Critical 9.8

In plain English

A critical-severity security flaw in IPVPN from FatPipe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.5% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)5.5%top 7.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.

Affected products (as reported)

Vendor	Product	Versions
FatPipe	WARP	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42
FatPipe	IPVPN	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42
FatPipe	MPVPN	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5684.php x_refsource_MISC
https://www.fatpipeinc.com/support/cve-list.php x_refsource_CONFIRM
https://www.zeroscience.mk/codes/fatpipe_backdoor.txt x_refsource_MISC