by Kastro
Paper/Archive/CVE-2021-27860

CVE-2021-27860

FatPipe WARP — Arbitrary file upload vulnerability in FatPipe software

KEV · due 24 JanEPSS 40%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 98.6.986 × 2019.7Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.

Affected

ProductAffectedFixed inSource
WARP10.1 – < 10.1.2r60p9210.1.2r60p92CNA
WARP10.2 – < 10.2.2r44p110.2.2r44p1CNA
IPVPN10.1 – < 10.1.2r60p9210.1.2r60p92CNA
IPVPN10.2 – < 10.2.2r44p110.2.2r44p1CNA
MPVPN10.1 – < 10.1.2r60p9210.1.2r60p92CNA
MPVPN10.2 – < 10.2.2r44p110.2.2r44p1CNA

Scores by source

certcc (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reffatpipeinc.com/support/cve-list.phprefic3.gov/Media/News/2021/211117-2.pdfrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27860kevcisa.gov/known-exploited-vulnerabilities-catalog