How severe is CVE-2021-27860?

CVE-2021-27860 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 39.8% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2021-27860: Arbitrary file upload vulnerability in FatPipe

CISA Known Exploited Vulnerabilities

FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-01-10

Remediation due

2022-01-24

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-27860

Description

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.

Severity

CVSS 3.1 · CNA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
FatPipe	WARP	10.1 to <10.1.2r60p92 10.2 to <10.2.2r44p1
FatPipe	IPVPN	10.1 to <10.1.2r60p92 10.2 to <10.2.2r44p1
FatPipe	MPVPN	10.1 to <10.1.2r60p92 10.2 to <10.2.2r44p1

References

2 Links

Other references

Record Details

Published

2021-12-08

Last updated

2025-10-21

Assigner (CNA)

certcc

Credited to

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.