by Kastro
Paper/Archive/CVE-2021-27856

CVE-2021-27856

FatPipe WARP — FatPipe software administrative account with no password

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 92.8.928 × 2018.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.

Affected

ProductAffectedFixed inSource
WARP10.1 – < 10.1.2r60p9110.1.2r60p91CNA
WARP10.2 – < 10.2.2r4210.2.2r42CNA
IPVPN10.1 – < 10.1.2r60p9110.1.2r60p91CNA
IPVPN10.2 – < 10.2.2r4210.2.2r42CNA
MPVPN10.1 – < 10.1.2r60p9110.1.2r60p91CNA
MPVPN10.2 – < 10.2.2r4210.2.2r42CNA

Scores by source

certcc (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refzeroscience.mk/en/vulnerabilities/ZSL-2021-5684.phpreffatpipeinc.com/support/cve-list.phprefzeroscience.mk/codes/fatpipe_backdoor.txt