CVE-2021-27860
FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
Description
CVE-2021-27860 is a critical unrestricted file upload vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software. The flaw allows a remote, unauthenticated attacker to upload arbitrary files to any location on the filesystem, which can be leveraged for remote code execution. With a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score of 42.56% (97.4th percentile), this FatPipe vulnerability poses a significant exploitation risk. CISA has added CVE-2021-27860 to its Known Exploited Vulnerabilities catalog, and the FBI has issued an alert confirming active exploitation of this vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fatpipeinc | ipvpn firmware | 5.2.0; 6.1.2; 7.1.2; 9.1.2; 10.1.2; 10.2.2 |
| fatpipeinc | warp firmware | 5.2.0; 6.1.2; 7.1.2; 9.1.2; 10.1.2; 10.2.2 |
| fatpipeinc | mpvpn firmware | 5.2.0; 6.1.2; 7.1.2; 9.1.2; 10.1.2; 10.2.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.fatpipeinc.com/support/cve-list.php(Vendor Advisory)
- https://www.ic3.gov/Media/News/2021/211117-2.pdf(Exploit, Mitigation, Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27860(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload in FatPipe WARP, IPVPN, and MPVPN allows remote unauthenticated attackers to upload files with dangerous content, such as web shells or malicious scripts, to arbitrary locations on the device filesystem. The web management interface fails to properly validate or restrict uploaded file types and destination paths, enabling attackers to place executable files in locations where they can be triggered to achieve remote code execution.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2021-27860 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating maximum-severity risk for affected organizations. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication or user interaction, making it straightforward for attackers to exploit against any exposed FatPipe device. Confidentiality (High): attackers can read sensitive configuration data, VPN credentials, and network traffic flowing through the compromised device. Integrity (High): arbitrary file upload enables deployment of backdoors, modification of device configuration, and manipulation of network routing. Availability (High): attackers can disrupt VPN connectivity and network operations, potentially isolating remote offices and disrupting business operations. The EPSS score of 42.56% (97.4th percentile) indicates a high likelihood of exploitation, and the FBI has issued an advisory confirming active attacks targeting this vulnerability.
Exploit Maturity
CVE-2021-27860 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with an accelerated remediation deadline of 2022-01-24. The FBI has published an advisory with technical details and indicators of compromise confirming that an APT actor exploited this vulnerability to gain access to FatPipe devices. The EPSS score of 42.56% (97.4th percentile) indicates a high probability of exploitation. The combination of unauthenticated remote access, arbitrary file write capability, and confirmed nation-state exploitation makes this vulnerability an urgent priority for remediation.
Remediation
- Apply updates per vendor instructions as mandated by CISA KEV. Upgrade FatPipe WARP, IPVPN, and MPVPN firmware to version 10.1.2r60p92 or 10.2.2r44p1 or later, as listed on the FatPipe advisory page.
- Immediately restrict access to the web management interface of FatPipe devices to trusted management networks only. Disable management access from the WAN interface if not strictly required.
- Review device filesystems for unauthorized files, particularly web shells or scripts in web-accessible directories, and check for signs of configuration tampering or unauthorized user accounts.
- Monitor network traffic and device logs for indicators of compromise as detailed in the FBI advisory (IC3), including unusual file upload activity, unexpected outbound connections, and anomalous authentication attempts.
- Implement network segmentation to isolate FatPipe devices from critical internal resources, and deploy intrusion detection signatures to alert on exploitation attempts targeting the file upload vulnerability.
Technical Details
CVE-2021-27860 targets the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1. The vulnerability allows unauthenticated remote attackers to upload files to arbitrary filesystem locations by exploiting insufficient input validation in the file upload functionality of the management interface (FatPipe advisory FPSA006). The underlying weakness, CWE-434 (Unrestricted Upload of File with Dangerous Type), means the application fails to validate file types, content, or destination paths, allowing attackers to write malicious files such as web shells to executable locations. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is straightforward: network-accessible, low complexity, no authentication, and no user interaction required, with full impact on confidentiality, integrity, and availability of the device.
Frequently Asked Questions
Is CVE-2021-27860 being actively exploited?
Yes. CVE-2021-27860 is listed in the CISA Known Exploited Vulnerabilities catalog, and the FBI has published an advisory confirming active exploitation by an APT actor. The EPSS score of 42.56% (97.4th percentile) indicates a high probability of exploitation.
What products are affected by CVE-2021-27860?
CVE-2021-27860 affects FatPipe WARP, IPVPN, and MPVPN firmware across multiple version branches including 5.2.0, 6.1.2, 7.1.2, 9.1.2, 10.1.2, and 10.2.2. All three product lines share the same vulnerable web management interface.
How do I fix CVE-2021-27860?
Upgrade FatPipe firmware to version 10.1.2r60p92 or 10.2.2r44p1 or later. As an immediate mitigation, restrict access to the web management interface to trusted networks only and disable WAN-facing management access.
How severe is CVE-2021-27860?
CVE-2021-27860 has a CVSS 3.1 score of 9.8 (CRITICAL). It allows unauthenticated remote file upload to arbitrary filesystem locations, effectively enabling remote code execution. The 42.56% EPSS score places it in the 97.4th percentile of exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.