Vulnerabilities > CVE-2021-27856 - Unspecified vulnerability in Fatpipeinc Ipvpn Firmware and Mpvpn Firmware

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

fatpipeinc

critical

NVD

Published: 2021-12-15

Updated: 2022-07-12

Summary

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.

Vulnerable Configurations

Part	Description	Count
OS	Fatpipeinc Fatpipeinc Ipvpn Firmware 5.2.0 Fatpipeinc Ipvpn Firmware 6.1.2 Fatpipeinc Ipvpn Firmware 7.1.2 Fatpipeinc Ipvpn Firmware 9.1.2 Fatpipeinc Ipvpn Firmware 10.1.2 Fatpipeinc Ipvpn Firmware 10.2.2 Fatpipeinc Mpvpn Firmware 5.2.0 Fatpipeinc Mpvpn Firmware 6.1.2 Fatpipeinc Mpvpn Firmware 7.1.2 Fatpipeinc Mpvpn Firmware 9.1.2 Fatpipeinc Mpvpn Firmware 10.1.2 Fatpipeinc Mpvpn Firmware 10.2.2 Fatpipeinc Warp Firmware 5.2.0 Fatpipeinc Warp Firmware 6.1.2 Fatpipeinc Warp Firmware 7.1.2 Fatpipeinc Warp Firmware 9.1.2 Fatpipeinc Warp Firmware 10.1.2 Fatpipeinc Warp Firmware 10.2.2	108
Hardware	Fatpipeinc Fatpipeinc Ipvpn - Fatpipeinc Mpvpn - Fatpipeinc Warp -	3

Summary

Vulnerable Configurations

References