Security News > 2021 > November > FBI: FatPipe VPN Zero-Day Exploited by APT for 6 Months

A threat actor has been exploiting a zero-day vulnerability in FatPipe's virtual private network devices as a way to breach companies and gain access to their internal networks, since at least May, the FBI has warned.

"As of November 2021, FBI forensic analysis indicated exploitation of a 0-day vulnerability in the FatPipe MPVPN device software going back to at least May 2021," the bureau said in a flash alert on Tuesday.

The vulnerability affects all FatPipe WARP, MPVPN and IPVPN device software prior to the latest version releases: 10.1.2r60p93 and 10.2.2r44p1.

The flaw is caused by a lack of input and validation checking mechanisms for certain HTTP requests on an affected device, FatPipe said.

The FBI is urging system admins to upgrade their devices immediately and to follow other FatPipe security recommendations, including disabling UI and SSH access from the WAN interface when not actively using it.

The news means that FatPipe has joined a club nobody wants to be part of: The league of VPN and networking equipment makers whose systems have been exploited by cyberattackers.

News URL

https://threatpost.com/fbi-fatpipe-vpn-zero-day-exploited-apt/176453/