CVE-2021-27855: FatPipe software allows privilege escalation

Published Dec 15, 2021

Updated

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves administrative privileges. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA001.

Affected Software

111 affected components

Fatpipeinc Ipvpn Firmware=5.2.0-r34

Fatpipeinc Ipvpn Firmware=6.1.2-r70p26

Fatpipeinc Ipvpn Firmware=6.1.2-r70p45-m

Fatpipeinc Ipvpn Firmware=6.1.2-r70p75-m

Fatpipeinc Ipvpn Firmware=7.1.2-r39

Fatpipeinc Ipvpn Firmware=9.1.2-r129

Fatpipeinc Ipvpn Firmware=9.1.2-r144

Fatpipeinc Ipvpn Firmware=9.1.2-r150

Fatpipeinc Ipvpn Firmware=9.1.2-r156

Fatpipeinc Ipvpn Firmware=9.1.2-r161p12

Fatpipeinc Ipvpn Firmware=9.1.2-r161p16

Fatpipeinc Ipvpn Firmware=9.1.2-r161p17

Fatpipeinc Ipvpn Firmware=9.1.2-r161p2

Fatpipeinc Ipvpn Firmware=9.1.2-r161p20

Fatpipeinc Ipvpn Firmware=9.1.2-r161p26

Fatpipeinc Ipvpn Firmware=9.1.2-r161p3

Fatpipeinc Ipvpn Firmware=9.1.2-r164

Fatpipeinc Ipvpn Firmware=9.1.2-r164p4

Fatpipeinc Ipvpn Firmware=9.1.2-r164p5

Fatpipeinc Ipvpn Firmware=9.1.2-r165

Fatpipeinc Ipvpn Firmware=9.1.2-r180p2

Fatpipeinc Ipvpn Firmware=9.1.2-r185

Fatpipeinc Ipvpn Firmware=10.1.2-r60p10

Fatpipeinc Ipvpn Firmware=10.1.2-r60p13

Fatpipeinc Ipvpn Firmware=10.1.2-r60p32

Fatpipeinc Ipvpn Firmware=10.1.2-r60p35

Fatpipeinc Ipvpn Firmware=10.1.2-r60p45

Fatpipeinc Ipvpn Firmware=10.1.2-r60p55

Fatpipeinc Ipvpn Firmware=10.1.2-r60p58

Fatpipeinc Ipvpn Firmware=10.1.2-r60p58s1

Fatpipeinc Ipvpn Firmware=10.1.2-r60p65

Fatpipeinc Ipvpn Firmware=10.1.2-r60p71

Fatpipeinc Ipvpn Firmware=10.1.2-r60p82

Fatpipeinc Ipvpn Firmware=10.2.2-r10

Fatpipeinc Ipvpn Firmware=10.2.2-r25

Fatpipeinc Ipvpn Firmware=10.2.2-r38

Fatpipeinc Ipvpn

Fatpipeinc Warp Firmware=5.2.0-r34

Fatpipeinc Warp Firmware=6.1.2-r70p26

Fatpipeinc Warp Firmware=6.1.2-r70p45-m

Fatpipeinc Warp Firmware=6.1.2-r70p75-m

Fatpipeinc Warp Firmware=7.1.2-r39

Fatpipeinc Warp Firmware=9.1.2-r129

Fatpipeinc Warp Firmware=9.1.2-r144

Fatpipeinc Warp Firmware=9.1.2-r150

Fatpipeinc Warp Firmware=9.1.2-r156

Fatpipeinc Warp Firmware=9.1.2-r161p12

Fatpipeinc Warp Firmware=9.1.2-r161p16

Fatpipeinc Warp Firmware=9.1.2-r161p17

Fatpipeinc Warp Firmware=9.1.2-r161p2

Fatpipeinc Warp Firmware=9.1.2-r161p20

Fatpipeinc Warp Firmware=9.1.2-r161p26

Fatpipeinc Warp Firmware=9.1.2-r161p3

Fatpipeinc Warp Firmware=9.1.2-r164

Fatpipeinc Warp Firmware=9.1.2-r164p4

Fatpipeinc Warp Firmware=9.1.2-r164p5

Fatpipeinc Warp Firmware=9.1.2-r165

Fatpipeinc Warp Firmware=9.1.2-r180p2

Fatpipeinc Warp Firmware=9.1.2-r185

Fatpipeinc Warp Firmware=10.1.2-r60p10

Fatpipeinc Warp Firmware=10.1.2-r60p13

Fatpipeinc Warp Firmware=10.1.2-r60p32

Fatpipeinc Warp Firmware=10.1.2-r60p35

Fatpipeinc Warp Firmware=10.1.2-r60p45

Fatpipeinc Warp Firmware=10.1.2-r60p55

Fatpipeinc Warp Firmware=10.1.2-r60p58

Fatpipeinc Warp Firmware=10.1.2-r60p58s1

Fatpipeinc Warp Firmware=10.1.2-r60p65

Fatpipeinc Warp Firmware=10.1.2-r60p71

Fatpipeinc Warp Firmware=10.1.2-r60p82

Fatpipeinc Warp Firmware=10.2.2-r10

Fatpipeinc Warp Firmware=10.2.2-r25

Fatpipeinc Warp Firmware=10.2.2-r38

Fatpipeinc Warp

Fatpipeinc Mpvpn Firmware=5.2.0-r34

Fatpipeinc Mpvpn Firmware=6.1.2-r70p26

Fatpipeinc Mpvpn Firmware=6.1.2-r70p45-m

Fatpipeinc Mpvpn Firmware=6.1.2-r70p75-m

Fatpipeinc Mpvpn Firmware=7.1.2-r39

Fatpipeinc Mpvpn Firmware=9.1.2-r129

Fatpipeinc Mpvpn Firmware=9.1.2-r144

Fatpipeinc Mpvpn Firmware=9.1.2-r150

Fatpipeinc Mpvpn Firmware=9.1.2-r156

Fatpipeinc Mpvpn Firmware=9.1.2-r161p12

Fatpipeinc Mpvpn Firmware=9.1.2-r161p16

Fatpipeinc Mpvpn Firmware=9.1.2-r161p17

Fatpipeinc Mpvpn Firmware=9.1.2-r161p2

Fatpipeinc Mpvpn Firmware=9.1.2-r161p20

Fatpipeinc Mpvpn Firmware=9.1.2-r161p26

Fatpipeinc Mpvpn Firmware=9.1.2-r161p3

Fatpipeinc Mpvpn Firmware=9.1.2-r164

Fatpipeinc Mpvpn Firmware=9.1.2-r164p4

Fatpipeinc Mpvpn Firmware=9.1.2-r164p5

Fatpipeinc Mpvpn Firmware=9.1.2-r165

Fatpipeinc Mpvpn Firmware=9.1.2-r180p2

Fatpipeinc Mpvpn Firmware=9.1.2-r185

Fatpipeinc Mpvpn Firmware=10.1.2-r60p10

Fatpipeinc Mpvpn Firmware=10.1.2-r60p13

Fatpipeinc Mpvpn Firmware=10.1.2-r60p32

Fatpipeinc Mpvpn Firmware=10.1.2-r60p35

Fatpipeinc Mpvpn Firmware=10.1.2-r60p45

Fatpipeinc Mpvpn Firmware=10.1.2-r60p55

Fatpipeinc Mpvpn Firmware=10.1.2-r60p58

Fatpipeinc Mpvpn Firmware=10.1.2-r60p58s1

Fatpipeinc Mpvpn Firmware=10.1.2-r60p65

Fatpipeinc Mpvpn Firmware=10.1.2-r60p71

Fatpipeinc Mpvpn Firmware=10.1.2-r60p82

Fatpipeinc Mpvpn Firmware=10.2.2-r10

Fatpipeinc Mpvpn Firmware=10.2.2-r25

Fatpipeinc Mpvpn Firmware=10.2.2-r38

Fatpipeinc Mpvpn

Event History

Dec 15, 2021

CVE Published

via MITRE·04:14 PM

Data Sourced

via MITRE·04:14 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-27855?

CVE-2021-27855 has a medium severity level due to the potential for unauthorized privilege escalation.

How do I fix CVE-2021-27855?

To fix CVE-2021-27855, update your FatPipe WARP, IPVPN, or MPVPN software to version 10.1.2r60p91 or 10.2.2r42 or later.

Who is affected by CVE-2021-27855?

CVE-2021-27855 affects users of FatPipe WARP, IPVPN, and MPVPN software versions before the stated patched versions.

What type of vulnerability is CVE-2021-27855?

CVE-2021-27855 is a privilege escalation vulnerability allowing authenticated users with read-only access to gain administrative privileges.

Can older versions of FatPipe software be vulnerable to CVE-2021-27855?

Yes, older versions of FatPipe software prior to the patched releases can also be vulnerable to CVE-2021-27855.