FatPipe MPVPN EUVD-2026-81462

Exploitation requires that the appliance's web management interface - which is DISABLED BY DEFAULT - has been affirmatively enabled by the customer AND that the AuthFormServlet endpoint is network-reachable by the attacker. The affected devices must be FatPipe MPVPN, WARP, or IPVPN appliances running end-of-life firmware 10.1.2r60p100. Once the interface is reachable, no authentication and no user interaction are needed (PR:N/UI:N). Limiting factors: the default-disabled interface, FatPipe's recommended WAN access-control-list restrictions to trusted administrative networks, and the niche appliance footprint. Because the firmware is EOL, the only defenses are configuration hardening (disable/restrict the management interface) rather than a vendor patch.

The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects the worst-case: an unauthenticated remote attacker achieving arbitrary command execution as root via a shell-processed AuthFormServlet parameter - a textbook CWE-78 with maximum technical impact. However, raw CVSS overstates the aggregate real-world risk because of two mitigating deployment realities stated in the description: (1) the affected management interface is DISABLED BY DEFAULT and must be affirmatively enabled by the customer, and (2) the affected firmware (10.1.2r60p100) is end-of-life, meaning defense is mitigation-only (WAN ACLs, trusted-network restriction) rather than patching. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of widespread automated exploitation. SSVC-style read: exploitation=none observed, automatable=yes (unauth network-reachable command injection is highly automatable IF the interface is exposed), technical impact=total. Net: this is a genuinely critical flaw for the subset of deployments that have enabled the management interface on an internet- or untrusted-network-facing appliance and remain on EOL firmware, but the default-disabled gate and niche footprint likely make real exploitation targeted rather than mass-scale. Caveat: FatPipe appliances have a history of active exploitation (a prior FatPipe VPN flaw appeared in CISA KEV), so exposure should be treated seriously despite the absence of a KEV entry here.

An attacker locates a FatPipe MPVPN, WARP, or IPVPN appliance on EOL firmware 10.1.2r60p100 whose administrator has enabled the web management interface and left it reachable from an untrusted network. The attacker sends a crafted, unauthenticated request to the AuthFormServlet endpoint where authentication data is passed to a shell, injecting OS commands that the xtremed daemon executes as root. No public proof-of-concept is identified in the provided data; the attack is straightforward given the low complexity and lack of authentication once the interface is reachable.