Security readout for executives and security teams
Plain-English summary
This flaw lets an unauthenticated remote user reach part of the FatPipe web management interface. The published impact is not fully defined, but the CVE indicates likely confidentiality exposure. Business urgency depends on whether management interfaces are reachable from untrusted networks.
Executive priority
Treat this as a moderate-priority perimeter and management-plane risk. Patch or isolate exposed FatPipe management interfaces, especially where remote administration is reachable beyond trusted administrators.
Technical view
CVE-2021-27858 is a CWE-862 missing authorization issue in FatPipe WARP, IPVPN, and MPVPN before 10.1.2r60p91 and 10.2.2r42. The CVE states a remote attacker can access at least /fpui/jsp/index.jsp, with unknown impact presumed to affect confidentiality.
Likely exposure
Organizations running FatPipe WARP, IPVPN, or MPVPN 10.1 or 10.2 before the fixed builds are exposed if the web management interface is reachable by untrusted users. Older versions may also be vulnerable, but the source evidence is not definitive.
Exploitation context
The CVE has network attack vector, low complexity, no required privileges, and no user interaction. CISA KEV status is false in the supplied bundle, and no provided source confirms active exploitation.
Researcher notes
Evidence supports missing authorization and at least one reachable management URL, but the final impact is listed as unknown. Do not assume broader compromise without local validation or vendor confirmation.
Mitigation direction
- Upgrade affected FatPipe software to 10.1.2r60p91, 10.2.2r42, or later vendor-supported builds.
- Restrict web management access to trusted administrative networks or VPN access only.
- Review FatPipe’s CVE list for current vendor guidance and older-version applicability.
- Monitor management-interface access logs for unexpected unauthenticated requests.
- Prioritize replacement or upgrade for unsupported older FatPipe versions.
Validation and detection
- Inventory FatPipe WARP, IPVPN, and MPVPN appliances and record exact software builds.
- Confirm whether any web management interface is internet-facing or broadly reachable internally.
- Verify affected systems are at 10.1.2r60p91, 10.2.2r42, or later.
- Review web logs for requests to /fpui/jsp/index.jsp from untrusted sources.
- Check vendor documentation for any product-specific hotfix or support guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-27858 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.phpCVE reference · x_refsource_MISC
- https://www.fatpipeinc.com/support/cve-list.phpCVE reference · x_refsource_CONFIRM
- https://www.zeroscience.mk/codes/fatpipe_auth.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.