CVE-2021-27858: Fatpipeinc IPVPN Firmware

Medium severity, CVSS 5.3. EPSS: 2.8% chance of exploitation in the next 30 days.

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote attacker to access at least the URL "/fpui/jsp/index.jsp" leading to unknown impact, presumably some violation of confidentiality. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA004.

Affected products

• Fatpipeinc IPVPN Firmware: version 5.2.0 only; version 6.1.2 only; version 7.1.2 only; version 9.1.2 only; version 10.1.2 only; version 10.2.2 only
• Fatpipeinc MPVPN Firmware: version 5.2.0 only; version 6.1.2 only; version 7.1.2 only; version 9.1.2 only; version 10.1.2 only; version 10.2.2 only
• Fatpipeinc WARP Firmware: version 5.2.0 only; version 6.1.2 only; version 7.1.2 only; version 9.1.2 only; version 10.1.2 only; version 10.2.2 only

Published 2021-12-15. Last modified 2026-06-17.