CVE-2021-27860

What it actually does

CVE-2021-27860 is an unauthenticated arbitrary file upload vulnerability in the FatPipe WARP, IPVPN, and MPVPN web management interface. A remote attacker can cause the appliance to write attacker-supplied files to arbitrary filesystem locations. If the uploaded file is placed in a web-served directory or an execution path, this can lead to persistent web shell access, configuration tampering, credential exposure, or full compromise of the appliance. Because these products sit in network connectivity and VPN paths, compromise can also provide a foothold for traffic interception and lateral movement.

Why it matters to the business

Successful exploitation can turn a FatPipe network appliance into an attacker-controlled entry point into the organization. This may disrupt WAN/VPN connectivity, expose sensitive routing or VPN configuration, allow theft of credentials or traffic data, and support follow-on intrusion activity. The vulnerability is listed in CISA KEV, has known in-the-wild exploitation, and the CISA remediation deadline of 2022-01-24 has long passed, so any exposed unpatched device should be treated as high priority and potentially already targeted.

How an attack unfolds

An attacker scans for internet-accessible FatPipe WARP, IPVPN, or MPVPN management interfaces. After identifying a vulnerable version prior to the fixed releases, the attacker sends a crafted unauthenticated file-upload request to the web management interface. Because the interface fails to adequately validate the upload destination, filename, or path, the attacker writes a file to an arbitrary location on the appliance. In a common abuse case, the uploaded file is a web shell or script placed where the web server can execute it. The attacker then requests that file over HTTP or HTTPS to run commands, collect appliance configuration, modify files, create persistence, or use the appliance as a pivot point into internal networks. Public reporting and KEV status indicate active exploitation associated with FatPipe WARP, IPVPN, and MPVPN configuration-upload exploitation activity.

How to fix it

Upgrade affected FatPipe WARP, IPVPN, and MPVPN appliances to a fixed version: 10.1.2r60p92, 10.2.2r44p1, or a later vendor-supported release. If immediate upgrade is not possible, restrict web management access to a dedicated administrative network or VPN, block internet access to the management interface, enforce strong network ACLs, and monitor for unexpected file writes in web-accessible and configuration directories. Because this vulnerability is known exploited, remediation should include forensic review before returning the appliance to normal operation. If compromise is suspected, rebuild or reimage the appliance from trusted media, rotate administrative and VPN credentials, review configuration integrity, and validate that no unauthorized files or accounts remain.

How to confirm the fix worked

Confirm the running FatPipe software version is 10.1.2r60p92, 10.2.2r44p1, or later according to vendor-supported release branches. Verify the management interface is not reachable from untrusted networks. Review web server and application logs to ensure unauthenticated upload attempts are rejected after patching. Perform an authenticated administrative configuration review to confirm there are no unexpected files, startup modifications, altered configurations, or unknown administrative users. If vulnerability scanning is used, rescan the appliance after upgrade and confirm the scanner no longer reports CVE-2021-27860 exposure.

Typical attack path

1. Identify internet-facing FatPipe WARP, IPVPN, or MPVPN web management interfaces.
2. Confirm the appliance appears to be running a vulnerable release prior to 10.1.2r60p92 or 10.2.2r44p1.
3. Send a crafted unauthenticated upload request to the management interface.
4. Use path manipulation or weak upload validation to write the file to a chosen filesystem location.
5. Place a script, web shell, modified configuration file, or persistence artifact on the appliance.
6. Access the uploaded file or altered component to execute commands or control appliance behavior.
7. Harvest VPN, routing, configuration, or credential material and use the appliance for persistence or lateral movement.

How to detect it

Investigate whether vulnerable FatPipe appliances were exposed to untrusted networks before patching. Review web management, HTTP/HTTPS access, application, system, and file-integrity logs for unauthenticated upload activity, unusual POST requests, path traversal patterns, file writes outside expected upload locations, and later requests to newly created files. Look for executable files, scripts, web shells, or configuration changes with timestamps near suspicious web requests. Correlate appliance logs with firewall, proxy, VPN, EDR, and NetFlow records for unusual outbound connections from the appliance, connections to rare external IPs, scanning behavior, or internal lateral movement after suspicious upload events. Because exploitation has been observed in the wild, absence of a crash or service outage is not evidence of safety; prioritize artifact review, configuration comparison against trusted backups, and credential rotation if compromise cannot be confidently excluded.

What your security team should do

• Treat any internet-exposed vulnerable FatPipe appliance as potentially compromised because the vulnerability is in CISA KEV and has active in-the-wild exploitation.
• Upgrade immediately to 10.1.2r60p92, 10.2.2r44p1, or later vendor-supported releases.
• Remove public internet access to FatPipe web management interfaces; allow access only from trusted administrative networks.
• Run incident-response triage on vulnerable or previously exposed appliances before assuming patching alone is sufficient.
• Search for unexpected uploaded files, especially executable scripts or web shells in web-served directories and appliance configuration paths.
• Review web access logs for unauthenticated upload requests and subsequent access to newly created files.
• Rotate appliance administrator credentials, VPN/shared secrets, API keys, and any credentials stored on or managed by the appliance if compromise cannot be ruled out.
• Validate routing, VPN, and security configurations against known-good backups to detect attacker modifications.
• Increase monitoring of network traffic from the appliance for unusual outbound connections, scanning, command-and-control behavior, or lateral movement attempts.