FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-01-10
• EPSS: 40% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.

CISA: A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Jan 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• www.fatpipeinc.com/support/cve-list.phpVendor Advisory
• www.ic3.gov/Media/News/2021/211117-2.pdfExploitMitigationThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource