FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named cmuser that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ipvpn_firmware | Fatpipeinc | 5.2.0-r34 (including) | 5.2.0-r34 (including) |
| Ipvpn_firmware | Fatpipeinc | 6.1.2-r70p26 (including) | 6.1.2-r70p26 (including) |
| Ipvpn_firmware | Fatpipeinc | 6.1.2-r70p45-m (including) | 6.1.2-r70p45-m (including) |
| Ipvpn_firmware | Fatpipeinc | 6.1.2-r70p75-m (including) | 6.1.2-r70p75-m (including) |
| Ipvpn_firmware | Fatpipeinc | 7.1.2-r39 (including) | 7.1.2-r39 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r129 (including) | 9.1.2-r129 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r144 (including) | 9.1.2-r144 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r150 (including) | 9.1.2-r150 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r156 (including) | 9.1.2-r156 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r161p12 (including) | 9.1.2-r161p12 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r161p16 (including) | 9.1.2-r161p16 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r161p17 (including) | 9.1.2-r161p17 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r161p2 (including) | 9.1.2-r161p2 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r161p20 (including) | 9.1.2-r161p20 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r161p26 (including) | 9.1.2-r161p26 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r161p3 (including) | 9.1.2-r161p3 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r164 (including) | 9.1.2-r164 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r164p4 (including) | 9.1.2-r164p4 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r164p5 (including) | 9.1.2-r164p5 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r165 (including) | 9.1.2-r165 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r180p2 (including) | 9.1.2-r180p2 (including) |
| Ipvpn_firmware | Fatpipeinc | 9.1.2-r185 (including) | 9.1.2-r185 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p10 (including) | 10.1.2-r60p10 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p13 (including) | 10.1.2-r60p13 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p32 (including) | 10.1.2-r60p32 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p35 (including) | 10.1.2-r60p35 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p45 (including) | 10.1.2-r60p45 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p55 (including) | 10.1.2-r60p55 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p58 (including) | 10.1.2-r60p58 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p58s1 (including) | 10.1.2-r60p58s1 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p65 (including) | 10.1.2-r60p65 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p71 (including) | 10.1.2-r60p71 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.1.2-r60p82 (including) | 10.1.2-r60p82 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.2.2-r10 (including) | 10.2.2-r10 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.2.2-r25 (including) | 10.2.2-r25 (including) |
| Ipvpn_firmware | Fatpipeinc | 10.2.2-r38 (including) | 10.2.2-r38 (including) |
References
- https://www.fatpipeinc.com/support/cve-list.php
- https://www.zeroscience.mk/codes/fatpipe_backdoor.txt
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5684.php
- https://www.fatpipeinc.com/support/cve-list.php
- https://www.zeroscience.mk/codes/fatpipe_backdoor.txt
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5684.php