CVE-2021-27857: FatPipe software allows unauthenticated configuration download

Published Dec 15, 2021
·
Updated

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, unauthenticated attacker to download a configuration archive. The attacker needs to know or correctly guess the hostname of the target system since the hostname is used as part of the configuration archive file name. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA003.

Affected Software

111 affected components
Fatpipeinc Ipvpn Firmware=5.2.0-r34
Fatpipeinc Ipvpn Firmware=6.1.2-r70p26
Fatpipeinc Ipvpn Firmware=6.1.2-r70p45-m
Fatpipeinc Ipvpn Firmware=6.1.2-r70p75-m
Fatpipeinc Ipvpn Firmware=7.1.2-r39
Fatpipeinc Ipvpn Firmware=9.1.2-r129
Fatpipeinc Ipvpn Firmware=9.1.2-r144
Fatpipeinc Ipvpn Firmware=9.1.2-r150
Fatpipeinc Ipvpn Firmware=9.1.2-r156
Fatpipeinc Ipvpn Firmware=9.1.2-r161p12
Fatpipeinc Ipvpn Firmware=9.1.2-r161p16
Fatpipeinc Ipvpn Firmware=9.1.2-r161p17
Fatpipeinc Ipvpn Firmware=9.1.2-r161p2
Fatpipeinc Ipvpn Firmware=9.1.2-r161p20
Fatpipeinc Ipvpn Firmware=9.1.2-r161p26
Fatpipeinc Ipvpn Firmware=9.1.2-r161p3
Fatpipeinc Ipvpn Firmware=9.1.2-r164
Fatpipeinc Ipvpn Firmware=9.1.2-r164p4
Fatpipeinc Ipvpn Firmware=9.1.2-r164p5
Fatpipeinc Ipvpn Firmware=9.1.2-r165
Fatpipeinc Ipvpn Firmware=9.1.2-r180p2
Fatpipeinc Ipvpn Firmware=9.1.2-r185
Fatpipeinc Ipvpn Firmware=10.1.2-r60p10
Fatpipeinc Ipvpn Firmware=10.1.2-r60p13
Fatpipeinc Ipvpn Firmware=10.1.2-r60p32
Fatpipeinc Ipvpn Firmware=10.1.2-r60p35
Fatpipeinc Ipvpn Firmware=10.1.2-r60p45
Fatpipeinc Ipvpn Firmware=10.1.2-r60p55
Fatpipeinc Ipvpn Firmware=10.1.2-r60p58
Fatpipeinc Ipvpn Firmware=10.1.2-r60p58s1
Fatpipeinc Ipvpn Firmware=10.1.2-r60p65
Fatpipeinc Ipvpn Firmware=10.1.2-r60p71
Fatpipeinc Ipvpn Firmware=10.1.2-r60p82
Fatpipeinc Ipvpn Firmware=10.2.2-r10
Fatpipeinc Ipvpn Firmware=10.2.2-r25
Fatpipeinc Ipvpn Firmware=10.2.2-r38
Fatpipeinc Ipvpn
Fatpipeinc Mpvpn Firmware=5.2.0-r34
Fatpipeinc Mpvpn Firmware=6.1.2-r70p26
Fatpipeinc Mpvpn Firmware=6.1.2-r70p45-m
Fatpipeinc Mpvpn Firmware=6.1.2-r70p75-m
Fatpipeinc Mpvpn Firmware=7.1.2-r39
Fatpipeinc Mpvpn Firmware=9.1.2-r129
Fatpipeinc Mpvpn Firmware=9.1.2-r144
Fatpipeinc Mpvpn Firmware=9.1.2-r150
Fatpipeinc Mpvpn Firmware=9.1.2-r156
Fatpipeinc Mpvpn Firmware=9.1.2-r161p12
Fatpipeinc Mpvpn Firmware=9.1.2-r161p16
Fatpipeinc Mpvpn Firmware=9.1.2-r161p17
Fatpipeinc Mpvpn Firmware=9.1.2-r161p2
Fatpipeinc Mpvpn Firmware=9.1.2-r161p20
Fatpipeinc Mpvpn Firmware=9.1.2-r161p26
Fatpipeinc Mpvpn Firmware=9.1.2-r161p3
Fatpipeinc Mpvpn Firmware=9.1.2-r164
Fatpipeinc Mpvpn Firmware=9.1.2-r164p4
Fatpipeinc Mpvpn Firmware=9.1.2-r164p5
Fatpipeinc Mpvpn Firmware=9.1.2-r165
Fatpipeinc Mpvpn Firmware=9.1.2-r180p2
Fatpipeinc Mpvpn Firmware=9.1.2-r185
Fatpipeinc Mpvpn Firmware=10.1.2-r60p10
Fatpipeinc Mpvpn Firmware=10.1.2-r60p13
Fatpipeinc Mpvpn Firmware=10.1.2-r60p32
Fatpipeinc Mpvpn Firmware=10.1.2-r60p35
Fatpipeinc Mpvpn Firmware=10.1.2-r60p45
Fatpipeinc Mpvpn Firmware=10.1.2-r60p55
Fatpipeinc Mpvpn Firmware=10.1.2-r60p58
Fatpipeinc Mpvpn Firmware=10.1.2-r60p58s1
Fatpipeinc Mpvpn Firmware=10.1.2-r60p65
Fatpipeinc Mpvpn Firmware=10.1.2-r60p71
Fatpipeinc Mpvpn Firmware=10.1.2-r60p82
Fatpipeinc Mpvpn Firmware=10.2.2-r10
Fatpipeinc Mpvpn Firmware=10.2.2-r25
Fatpipeinc Mpvpn Firmware=10.2.2-r38
Fatpipeinc Mpvpn
Fatpipeinc Warp Firmware=5.2.0-r34
Fatpipeinc Warp Firmware=6.1.2-r70p26
Fatpipeinc Warp Firmware=6.1.2-r70p45-m
Fatpipeinc Warp Firmware=6.1.2-r70p75-m
Fatpipeinc Warp Firmware=7.1.2-r39
Fatpipeinc Warp Firmware=9.1.2-r129
Fatpipeinc Warp Firmware=9.1.2-r144
Fatpipeinc Warp Firmware=9.1.2-r150
Fatpipeinc Warp Firmware=9.1.2-r156
Fatpipeinc Warp Firmware=9.1.2-r161p12
Fatpipeinc Warp Firmware=9.1.2-r161p16
Fatpipeinc Warp Firmware=9.1.2-r161p17
Fatpipeinc Warp Firmware=9.1.2-r161p2
Fatpipeinc Warp Firmware=9.1.2-r161p20
Fatpipeinc Warp Firmware=9.1.2-r161p26
Fatpipeinc Warp Firmware=9.1.2-r161p3
Fatpipeinc Warp Firmware=9.1.2-r164
Fatpipeinc Warp Firmware=9.1.2-r164p4
Fatpipeinc Warp Firmware=9.1.2-r164p5
Fatpipeinc Warp Firmware=9.1.2-r165
Fatpipeinc Warp Firmware=9.1.2-r180p2
Fatpipeinc Warp Firmware=9.1.2-r185
Fatpipeinc Warp Firmware=10.1.2-r60p10
Fatpipeinc Warp Firmware=10.1.2-r60p13
Fatpipeinc Warp Firmware=10.1.2-r60p32
Fatpipeinc Warp Firmware=10.1.2-r60p35
Fatpipeinc Warp Firmware=10.1.2-r60p45
Fatpipeinc Warp Firmware=10.1.2-r60p55
Fatpipeinc Warp Firmware=10.1.2-r60p58
Fatpipeinc Warp Firmware=10.1.2-r60p58s1
Fatpipeinc Warp Firmware=10.1.2-r60p65
Fatpipeinc Warp Firmware=10.1.2-r60p71
Fatpipeinc Warp Firmware=10.1.2-r60p82
Fatpipeinc Warp Firmware=10.2.2-r10
Fatpipeinc Warp Firmware=10.2.2-r25
Fatpipeinc Warp Firmware=10.2.2-r38
Fatpipeinc Warp

Event History

Dec 15, 2021
CVE Published
via MITRE·04:14 PM
Data Sourced
via MITRE·04:14 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2021-27857?

CVE-2021-27857 has a CVSS severity score indicating a high level of concern due to its potential for unauthorized access to sensitive configuration data.

2

How do I fix CVE-2021-27857?

To fix CVE-2021-27857, you should update affected FatPipe WARP, IPVPN, and MPVPN software to versions 10.1.2r60p91 or 10.2.2r42 or later.

3

What versions of FatPipe software are affected by CVE-2021-27857?

CVE-2021-27857 affects multiple versions including versions prior to 10.1.2r60p91 and 10.2.2r42 of FatPipe WARP, IPVPN, and MPVPN software.

4

What type of vulnerability is CVE-2021-27857?

CVE-2021-27857 is classified as a missing authorization vulnerability in the web management interface.

5

Can an attacker exploit CVE-2021-27857 remotely?

Yes, an attacker can exploit CVE-2021-27857 remotely without authentication to download configuration archives.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203