Actively exploited · Published Dec 8, 2021 · Assigned by certcc

CVE-2021-27860Arbitrary file upload vulnerability in FatPipe software

Critical 9.8 Exploited

In plain English

A critical-severity unrestricted file upload in IPVPN from FatPipe. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). The chance it is exploited in the next 30 days is estimated at 39.7% (higher than 99% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)39.7%top 1.4% of all CVEs

Exploited in the wildYesCISA KEV since Jan 10, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jan 24, 2022.

Official description

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.

Affected products (as reported)

Vendor	Product	Versions
FatPipe	WARP	10.1 – before 10.1.2r60p9210.2 – before 10.2.2r44p1
FatPipe	IPVPN	10.1 – before 10.1.2r60p9210.2 – before 10.2.2r44p1
FatPipe	MPVPN	10.1 – before 10.1.2r60p9210.2 – before 10.2.2r44p1

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

CISA guidance

Official description

Affected products (as reported)

References