Vulnerability · Published Dec 15, 2021 · Assigned by certcc

CVE-2021-27858Missing authorization vulnerability in FatPipe software

Medium 5.3

In plain English

A medium-severity missing authorization in IPVPN from FatPipe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)2.8%top 13.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote attacker to access at least the URL "/fpui/jsp/index.jsp" leading to unknown impact, presumably some violation of confidentiality. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA004.

Affected products (as reported)

Vendor	Product	Versions
FatPipe	WARP	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42
FatPipe	IPVPN	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42
FatPipe	MPVPN	10.1 – before 10.1.2r60p9110.2 – before 10.2.2r42

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.php x_refsource_MISC
https://www.fatpipeinc.com/support/cve-list.php x_refsource_CONFIRM
https://www.zeroscience.mk/codes/fatpipe_auth.txt x_refsource_MISC