CVE-2021-27859

—

CVSS 3.1

8.8 high

EPSS

2%p75

Published

Dec 15, 2021 (Dec 15, 2021)

Modified

Jun 17, 2026

Description

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows an authenticated, remote attacker with read-only privileges to create an account with administrative privileges. Older versions of FatPipe software may also be vulnerable. This does not appear to be a CSRF vulnerability. The FatPipe advisory identifier for this vulnerability is FPSA005.

Vendors: fatpipeinc
Products: ipvpn firmware, mpvpn firmware, warp firmware
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news0 stories

No ingested article mentions this CVE yet.