CVE-2021-27856

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2021
Source publication: Dec 15, 2021
Source updated: Sep 17, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

FatPipe software administrative account with no password

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WARP

Vendor: FatPipe
Product: WARP
Platforms: Unknown
Default status: Unknown

WARP · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
10.1	`affected`	custom	10.1.2r60p91	Unavailable	None listed
10.2	`affected`	custom	10.2.2r42	Unavailable	None listed

IPVPN

Vendor: FatPipe
Product: IPVPN
Platforms: Unknown
Default status: Unknown

IPVPN · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
10.1	`affected`	custom	10.1.2r60p91	Unavailable	None listed
10.2	`affected`	custom	10.2.2r42	Unavailable	None listed

MPVPN

Vendor: FatPipe
Product: MPVPN
Platforms: Unknown
Default status: Unknown

MPVPN · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
10.1	`affected`	custom	10.1.2r60p91	Unavailable	None listed
10.2	`affected`	custom	10.2.2r42	Unavailable	None listed