PT-2021-7647 · Fatpipe · Fatpipe Warp+2

Published 2021-11-18 · Updated 2025-10-24 · CVE-2021-27860

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FatPipe WARP, IPVPN, and MPVPN versions prior to 10.1.2r60p92 and 10.2.2r44p1

Description A vulnerability in the web management interface of FatPipe software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem, potentially enabling the execution of arbitrary code with a specially crafted malicious file.

Recommendations For versions prior to 10.1.2r60p92, update to version 10.1.2r60p92 or later. For versions prior to 10.2.2r44p1, update to version 10.2.2r44p1 or later. As a temporary workaround, consider restricting access to the web management interface to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-00811

CVE-2021-27860

Affected Products

Fatpipe Warp

Ipvpn

Mpvpn

References · 20

• 🔥 https://ic3.gov/Media/News/2021/211117-2.pdf · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2021-5681.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-27860 · Security Note
• https://fatpipeinc.com/support/cve-list.php · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27860 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00811 · Security Note
• https://twitter.com/fletch_ai/status/1755835681006391352 · Twitter Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://twitter.com/fletch_ai/status/1859129680697454830 · Twitter Post
• https://twitter.com/fletch_ai/status/1825790003471069217 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27860 · Note
• https://t.me/aptreports/6649 · Telegram Post
• https://twitter.com/fletch_ai/status/1753329164034167097 · Twitter Post
• https://t.me/aptreports/4071 · Telegram Post
• https://t.me/cibsecurity/33616 · Telegram Post