CVE-2021-27859: Fatpipeinc IPVPN Firmware

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows an authenticated, remote attacker with read-only privileges to create an account with administrative privileges. Older versions of FatPipe software may also be vulnerable. This does not appear to be a CSRF vulnerability. The FatPipe advisory identifier for this vulnerability is FPSA005.

Affected products

• Fatpipeinc IPVPN Firmware: version 5.2.0 only; version 6.1.2 only; version 7.1.2 only; version 9.1.2 only; version 10.1.2 only; version 10.2.2 only
• Fatpipeinc MPVPN Firmware: version 5.2.0 only; version 6.1.2 only; version 7.1.2 only; version 9.1.2 only; version 10.1.2 only; version 10.2.2 only
• Fatpipeinc WARP Firmware: version 5.2.0 only; version 6.1.2 only; version 7.1.2 only; version 9.1.2 only; version 10.1.2 only; version 10.2.2 only

Published 2021-12-15. Last modified 2026-06-17.