CVE-2021-27856: FatPipe software administrative account with no password

Description

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)5.5% · higher than 93% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

IP

IPVPN · FatPipe

10.1 before 10.1.2r60p91; 10.2 before 10.2.2r42 · source: vendor

MP

MPVPN · FatPipe

10.1 before 10.1.2r60p91; 10.2 before 10.2.2r42 · source: vendor

WA

WARP · FatPipe

10.1 before 10.1.2r60p91; 10.2 before 10.2.2r42 · source: vendor

IF

Ipvpn Firmware · Fatpipeinc

5.2.0; 6.1.2; 6.1.2; 6.1.2; 7.1.2; 9.1.2; +30 more · source: NVD

MF

Mpvpn Firmware · Fatpipeinc

5.2.0; 6.1.2; 6.1.2; 6.1.2; 7.1.2; 9.1.2; +30 more · source: NVD

WF

Warp Firmware · Fatpipeinc

5.2.0; 6.1.2; 6.1.2; 6.1.2; 7.1.2; 9.1.2; +30 more · source: NVD