CVE-2021-27860
FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run WARP, IPVPN, and MPVPN software, fix it now.
CISA required action: Apply updates per vendor instructions.
US federal civilian agencies must remediate by Jan 24, 2022.
Patch status
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.
Description
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Affected products
| Product | Vendor | Source |
|---|---|---|
| WARP, IPVPN, and MPVPN software | FatPipe | KEV |
Sources: KEV = CISA Known Exploited Vulnerabilities catalog. Version details have not been published yet.
Intelligence timeline
Developments from the last 30 days, newest first.
- CVSS scoredUpdateKEV
CVE-2021-27860 scored CVSS 8.8: FatPipe WARP, IPVPN, and MPVPN software, FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
CISA lists this as exploited in the wild. Unpatched WARP, IPVPN, and MPVPN software systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
1 earlier event is available with a subscription. See plans.
Coverage
We have not published a story about this vulnerability yet.