Vulnerability · Published Dec 15, 2021 · Assigned by certcc

CVE-2021-27857FatPipe software allows unauthenticated configuration download

High 7.5

In plain English

A high-severity missing authorization in IPVPN from FatPipe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.9%top 20.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, unauthenticated attacker to download a configuration archive. The attacker needs to know or correctly guess the hostname of the target system since the hostname is used as part of the configuration archive file name. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA003.

Affected products (as reported)

Vendor	Product	Versions
FatPipe	WARP	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42
FatPipe	IPVPN	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42
FatPipe	MPVPN	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5683.php x_refsource_MISC
https://www.fatpipeinc.com/support/cve-list.php x_refsource_CONFIRM
https://www.zeroscience.mk/codes/fatpipe_configdl.txt x_refsource_MISC