Report any new CVEs to FatPipe on VINCE, or contact our security team directly using the form.
FPSA001: Remote Privilege Escalation
Summary
A vulnerability in the web management interface of FatPipe software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to the level of an Administrator user on an affected device.
Affected Products
WARP, MPVPN, IPVPN
10.1.2 and 10.2.2 versions prior to releases with the fix (see Fixed Software).
Details
A vulnerability in the web management interface of FatPipe software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to the level of an Administrator user on an affected device.
The vulnerability is due to a lack of input and validation checking mechanisms for certain HTTP requests on an affected device. An attacker could exploit this vulnerability by sending a modified HTTP request to the affected device. An exploit could allow the attacker as a read-only user to execute functions as if they were an administrative user.
FatPipe has released software updates that address this vulnerability.
Workarounds
There are no workarounds that address this vulnerability. To mitigate the vulnerability, disable UI access on all the WAN interfaces or configure Access Lists on the interface page to allow access only from trusted sources.
Fixed Software
10.1.2r60p91 or later
10.2.2r42 or later
Source
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5685.phpFPSA002: Hidden Backdoor Account (Write Access)
Summary
For centralized management, FatPipe uses a user account that allows the current logged in user to access multiple devices from the web management interface of FatPipe software. This was not intended to be used to directly log into the web management interface. Someone can use it to log into the web interface.
Affected Products
WARP, MPVPN, IPVPN
10.1.2 and 10.2.2 versions prior to releases with the fix (see Fixed Software).
Details
For centralized management, FatPipe uses a user account that allows the current logged in user to access multiple appliances from the web management interface of FatPipe software. This was not intended to be used to directly log into the web management interface. Someone can use it to log into the web management interface.
While this user account is not displayed in the Users list, the customer has control over the password for this user account. On the Users page, you can set the password in for this user.
FatPipe has released software updates that address this vulnerability. Newer versions of our software do not allow a user to login directly using this user account (see Fixed Software).
Workarounds
Disable "Central Manager Login".
Fixed Software
10.1.2r60p91 or later
10.2.2r42 or later
Source
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5684.phpFPSA003: Unauthenticated Config Download
Summary
A user is able to create and download a backup file containing the FatPipe device's configuration using the web management interface of FatPipe software. A vulnerability exists where an unauthenticated user can access the backup file on the system.
Affected Products
WARP, MPVPN, IPVPN
10.1.2 and 10.2.2 versions prior to releases with the fix (see Fixed Software).
Details
A user is able to create and download a backup file containing the FatPipe device's configuration using the web management interface of FatPipe software. A vulnerability exists where an unauthenticated user can access the backup file on the system.
FatPipe has released software updates that address this vulnerability.
Workarounds
There are no workarounds that address this vulnerability. To mitigate the vulnerability, disable UI access on all the WAN interfaces or configure Access Lists on the interface page to allow access only from trusted sources.
Fixed Software
10.1.2r60p91 or later
10.2.2r42 or later
Source
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5683.phpFPSA004: Authorization Bypass
Summary
Improper access control occurs when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages.
Affected Products
WARP
10.1.2 and 10.2.2 versions prior to releases with the fix (see Fixed Software).
Details
Improper access control occurs when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages.
Workarounds
There are no workarounds that address this vulnerability. To mitigate the vulnerability, disable UI access on all the WAN interfaces or configure Access Lists on the interface page to allow access only from trusted sources.
Fixed Software
10.1.2r60p91 or later
10.2.2r42 or later
Source
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.phpFPSA005: CSRF Add Admin Exploit
Summary
A vulnerability in the web management interface of FatPipe software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to the level of an Administrator user on an affected device by adding a user with Administrator privileges.
Affected Products
WARP, MPVPN, IPVPN
10.1.2 and 10.2.2 versions prior to releases with the fix (see Fixed Software).
Details
A vulnerability in the web management interface of FatPipe software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to the level of an Administrator user on an affected device by adding a user with Administrator privileges.
The vulnerability is due to a lack of input and validation checking mechanisms for certain HTTP requests on an affected device. An attacker could exploit this vulnerability by sending a modified HTTP request to the affected device. An exploit could allow the attacker as a read-only user to execute functions as if they were an administrative user.
FatPipe has released software updates that address this vulnerability.
Workarounds
There are no workarounds that address this vulnerability. To mitigate the vulnerability, disable UI access on all the WAN interfaces or configure Access Lists on the interface page to allow access only from trusted sources.
Fixed Software
10.1.2r60p91 or later
10.2.2r42 or later
Source
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5681.phpFPSA006: Config Upload Exploit
Summary
A vulnerability in the web management interface of FatPipe software could allow a remote attacker to upload a file to any location on the filesystem on an affected device.
Affected Products
WARP, MPVPN, IPVPN
Version 10 prior to the fixed releases (see Fixed Software). Version 9 is not affected by this vulnerability.
Details
A vulnerability in the web management interface of FatPipe software could allow a remote attacker to upload a file to any location on the filesystem on an affected device.
The vulnerability is due to a lack of input and validation checking mechanisms for certain HTTP requests on an affected device. An attacker could exploit this vulnerability by sending a modified HTTP request to the affected device.
FatPipe has released software updates that address this vulnerability.
Workarounds
There are no workarounds that address this vulnerability. To mitigate the vulnerability, disable UI access on all the WAN interfaces or configure Access Lists on the interface page to allow access only from trusted sources..
Fixed Software
10.1.2r60p92 or later
10.2.2r44p1 or later
Source
Found by code review after being made aware of active exploit activity.
FPSA007: OS Command Injection in xtremed Daemon (CVE-2026-90822)
Summary
An OS command injection vulnerability in the xtremed daemon of FatPipe software could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on an affected device.
Affected Products
MPVPN, WARP, IPVPN
This vulnerability only affects end-of-life (EOL) software, version 10.1.2r60p100. Currently supported software releases are not affected.
Details
The vulnerability is due to insufficient validation of input submitted to the AuthFormServlet endpoint on the device's management interface. An attacker could exploit this vulnerability by submitting a crafted authentication request, causing the data to be processed by a shell and allowing arbitrary commands to execute as root. The affected management interface is disabled by default.
CVSS v3.1 Score: 9.8 (Critical) – CWE-78: OS Command Injection.
Workarounds
Keep the management interface disabled, restrict access to trusted networks, and configure WAN access control lists to allow access only from trusted sources.
Fixed Software
This vulnerability only impacts end-of-life (EOL) software that is no longer supported or maintained by FatPipe. There is no patched release for this EOL version. Customers running EOL software should contact FatPipe Support to upgrade to a current, supported software release.
Source
CVE-2026-90822 / Securifera Advisory (credit: Ryan Wincey, Securifera)FPSA008: Stack-Based Buffer Overflow in auth_user_pass (CVE-2026-90823)
Summary
A stack-based buffer overflow in the auth_user_pass component of FatPipe software could allow an unauthenticated, remote attacker with access to the management interface to execute arbitrary code with root privileges on an affected device.
Affected Products
MPVPN, WARP, IPVPN
This vulnerability only affects end-of-life (EOL) software, version 10.1.2r60p100. Currently supported software releases are not affected.
Details
The vulnerability is due to an unchecked copy of authentication request data into a fixed-size stack buffer in /usr/sbin/auth_user_pass. An attacker could exploit this vulnerability by submitting a crafted authentication request to the affected device's management interface, potentially resulting in arbitrary code execution with root privileges. The affected management interface is disabled by default and requires explicit customer activation.
CVSS v3.1 Score: 9.8 (Critical).
Workarounds
Keep the management interface disabled, restrict access to trusted networks, and avoid exposing the management interface to the public Internet.
Fixed Software
This vulnerability only impacts end-of-life (EOL) software that is no longer supported or maintained by FatPipe. There is no patched release for this EOL version. Customers running EOL software should contact FatPipe Support to upgrade to a current, supported software release.
Source
CVE-2026-90823 / Securifera Advisory (credit: Ryan Wincey, Securifera)