vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-27859

Missing authorization vulnerability in FatPipe software

HIGH
8.8
CVSS Score
Published: December 15, 2021 at 04:14 PM UTC
Updated: June 17, 2026 at 03:45 AM UTC
9 products affected across 2 vendorsMpvpn FirmwareIpvpn FirmwareWarp Firmware

Using WARP by FatPipe?

Get instant alerts when new vulnerabilities affect WARP - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 2%

Description

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows an authenticated, remote attacker with read-only privileges to create an account with administrative privileges. Older versions of FatPipe software may also be vulnerable. This does not appear to be a CSRF vulnerability. The FatPipe advisory identifier for this vulnerability is FPSA005.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ipvpn Firmware· Fatpipeinc
95%
10.1.2 r60p1010.1.2 r60p1310.1.2 r60p3210.1.2 r60p3510.1.2 r60p4510.1.2 r60p5510.1.2 r60p5810.1.2 r60p58s110.1.2 r60p6510.1.2 r60p7110.1.2 r60p8210.2.2 r1010.2.2 r2510.2.2 r385.2.0 r346.1.2 r70p266.1.2 r70p45-m6.1.2 r70p75-m7.1.2 r399.1.2 r1299.1.2 r1449.1.2 r1509.1.2 r1569.1.2 r161p129.1.2 r161p169.1.2 r161p179.1.2 r161p29.1.2 r161p209.1.2 r161p269.1.2 r161p39.1.2 r1649.1.2 r164p49.1.2 r164p59.1.2 r1659.1.2 r180p29.1.2 r185
fatpipeinc-ipvpn (same device)
Mpvpn Firmware· Fatpipeinc
95%
10.1.2 r60p1010.1.2 r60p1310.1.2 r60p3210.1.2 r60p3510.1.2 r60p4510.1.2 r60p5510.1.2 r60p5810.1.2 r60p58s110.1.2 r60p6510.1.2 r60p7110.1.2 r60p8210.2.2 r1010.2.2 r2510.2.2 r385.2.0 r346.1.2 r70p266.1.2 r70p45-m6.1.2 r70p75-m7.1.2 r399.1.2 r1299.1.2 r1449.1.2 r1509.1.2 r1569.1.2 r161p129.1.2 r161p169.1.2 r161p179.1.2 r161p29.1.2 r161p209.1.2 r161p269.1.2 r161p39.1.2 r1649.1.2 r164p49.1.2 r164p59.1.2 r1659.1.2 r180p29.1.2 r185
fatpipeinc-mpvpn (same device)
Warp Firmware· Fatpipeinc
95%
10.1.2 r60p1010.1.2 r60p1310.1.2 r60p3210.1.2 r60p3510.1.2 r60p4510.1.2 r60p5510.1.2 r60p5810.1.2 r60p58s110.1.2 r60p6510.1.2 r60p7110.1.2 r60p8210.2.2 r1010.2.2 r2510.2.2 r385.2.0 r346.1.2 r70p266.1.2 r70p45-m6.1.2 r70p75-m7.1.2 r399.1.2 r1299.1.2 r1449.1.2 r1509.1.2 r1569.1.2 r161p129.1.2 r161p169.1.2 r161p179.1.2 r161p29.1.2 r161p209.1.2 r161p269.1.2 r161p39.1.2 r1649.1.2 r164p49.1.2 r164p59.1.2 r1659.1.2 r180p29.1.2 r185
fatpipeinc-warp (same device)
IPVPN· Fatpipe
60%
10.1 ≤ v < 10.1.2r60p9110.2 ≤ v < 10.2.2r4210.110.2
Affected range stops below 10.1.2r60p91, so it looks safe — our inference, not a vendor statement
Affected range stops below 10.2.2r42, so it looks safe — our inference, not a vendor statement
MPVPN· Fatpipe
60%
10.1 ≤ v < 10.1.2r60p9110.2 ≤ v < 10.2.2r4210.110.2
Affected range stops below 10.1.2r60p91, so it looks safe — our inference, not a vendor statement
Affected range stops below 10.2.2r42, so it looks safe — our inference, not a vendor statement
WARP· Fatpipe
60%
10.1 ≤ v < 10.1.2r60p9110.2 ≤ v < 10.2.2r4210.110.2
Affected range stops below 10.1.2r60p91, so it looks safe — our inference, not a vendor statement
Affected range stops below 10.2.2r42, so it looks safe — our inference, not a vendor statement
Ipvpn· Fatpipeincdevice
80%
All versions
Mpvpn· Fatpipeincdevice
80%
All versions
Warp· Fatpipeincdevice
80%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://www.fatpipeinc.com/support/cve-list.php
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.zeroscience.mk/codes/fatpipe_csrf.txt
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5681.php

CVSS

8.8HIGHcertcc
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-862

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card