EUVD-2026-81463
GHSA-32q2-w7qg-44p8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed management interface
-
DeliverySend crafted authentication request
-
ExploitOverflow fixed-size stack buffer in auth_user_pass
-
ExecutionHijack execution flow
-
ImpactExecute arbitrary code as root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the FatPipe management interface to be affirmatively ENABLED by the customer - it is disabled by default, so out-of-the-box deployments are not reachable/exploitable. The attacker must have network reachability to that interface, which the vendor recommends restricting to trusted administrative networks via WAN access control lists; where such ACLs are configured, exploitation is limited to trusted sources. Affected only on the end-of-life firmware version 10.1.2r60p100 of MPVPN, WARP, and IPVPN appliances; because the firmware is EOL there is no patch, so exposure persists until the appliance is decommissioned or network-isolated. When those gates are met, no authentication or user interaction is required (PR:N/UI:N). |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a textbook unauthenticated remote root RCE, and the base metrics are internally consistent with the description of a stack-based buffer overflow reached via a crafted authentication request. I broadly agree with the base metrics. However, the raw 9.8 overstates real-world urgency for two documented reasons: (1) the vulnerable management interface is DISABLED BY DEFAULT and must be affirmatively enabled by the customer, and (2) the affected firmware 10.1.2r60p100 is END-OF-LIFE with no patch - mitigation (WAN ACLs, restricting management access to trusted admin networks) is the only remedy. These environmental limiters are not reflected in the base score. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so despite the maximal severity there is no evidence of active or imminent exploitation at time of analysis. Vendor context matters: FatPipe edge appliances previously appeared in CISA KEV (CVE-2021-27860), so this vendor's devices are a known target class, which argues for treating the flaw seriously where the management interface is exposed even though this specific CVE is not yet weaponized. Net: genuinely critical WHERE the interface is reachable, but gated to a non-default configuration on an EOL product, so the real-world blast radius is narrower than the 9.8 implies. |
| Exploit ScenarioDerived | An attacker who can reach the FatPipe management interface (one the customer has enabled and not restricted via WAN ACLs) submits a crafted authentication request whose oversized field is copied unchecked into a fixed-size stack buffer in /usr/sbin/auth_user_pass, overflowing it. By controlling the overflow the attacker hijacks execution and runs arbitrary code as root with no credentials required. No public exploit code is identified at time of analysis; the issue was reported by Securifera but only a generic advisories index page is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Remote code execution as root on FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life 10.1.2r60p100 firmware is possible when an attacker can reach the management interface and submit a crafted authentication request that overflows a fixed-size stack buffer in /usr/sbin/auth_user_pass. The vendor score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact, but real-world exposure is gated: the management interface is disabled by default and must be affirmatively enabled by the customer, and WAN access control lists are recommended to restrict reachability to trusted administrative networks. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; because 10.1.2r60p100 is end-of-life, no patched firmware version has been identified, so exposure persists until the appliance is decommissioned or tightly network-isolated.
RemediationAI
No vendor-released patch was identified at time of analysis, and because 10.1.2r60p100 is end-of-life firmware, remediation depends on migrating off the affected build - upgrade MPVPN, WARP, and IPVPN appliances to a currently supported FatPipe firmware release if one is available for the platform, or decommission and replace the appliance where it is not. Until that migration is complete, the primary compensating control is to leave the management interface DISABLED, which is the default state and the single most effective mitigation; the trade-off is loss of remote administration, requiring local/console management instead. If the interface must stay enabled, restrict reachability with WAN access control lists so only trusted administrative source networks can reach it, accepting that exploitation is then limited to those trusted sources and that any compromised or spoofed trusted host becomes a viable attack origin. Additional controls with their trade-offs include placing the management plane on a dedicated out-of-band VLAN or management network isolated from untrusted segments (requires network re-architecture), fronting the interface with an authenticating reverse proxy or jump host so crafted requests never reach auth_user_pass directly (adds a dependency and latency, and only works if the proxy fully terminates the request path), and logging/monitoring all connections to the management interface for anomalous authentication payloads (detection only, does not prevent exploitation). Because the appliance's own authentication helper is the vulnerable component, do not rely on authentication itself as a mitigation. Consult the Securifera advisory at https://www.securifera.com/advisories/ and FatPipe's guidance on restricting management access to trusted networks and using WAN ACLs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-121) in the FatPipe authentication helper binary /usr/sbin/auth_user_pass, which is invoked to process authentication requests arriving over the appliance's management interface. A crafted request causes data to be copied into a fixed-size stack buffer without adequate bounds checking, corrupting adjacent stack memory (saved registers and return addresses) and creating a path to arbitrary code execution in the context of the root-owned helper. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms the vulnerable code path is reachable over the network prior to authentication and requires no user interaction, meaning the overflow is triggered during, not after, credential processing. The weakness is specific to end-of-life firmware version 10.1.2r60p100 on the MPVPN, WARP, and IPVPN product lines; no CPE identifiers were supplied with the source data, so affected assets should be identified by product name plus the exact firmware build. The management interface listens on the appliance's administrative service and is disabled by default, so any reachable instance indicates an explicit administrative configuration change.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable crafted request triggers a straightforward stack overflow to root code execution (PR:N/AC:L, full triad); the default-disabled interface is an environmental gate, not a base-metric change.
Primary rating from Vendor (securifera).
CVSS VectorVendor: securifera
DescriptionCVE.org
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root.
The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources.
Executive ViewAI
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life 10.1.2r60p100 firmware are exposed to a critical unauthenticated remote code execution flaw that, if reachable, would let an attacker seize full root control of the device and the network segments it protects. The concern for leadership is structural: this firmware is no longer supported, so no vendor fix is anticipated and the exposure will persist until affected appliances are isolated or retired. Risk is concentrated in organizations that have affirmatively enabled the management interface or left it reachable from untrusted networks, since the interface is off by default and no public exploit code has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: keep the management interface disabled (its default state), restrict administrative reachability via WAN ACLs to trusted networks, segment and isolate the management plane from untrusted traffic, monitor authentication logs for crafted requests targeting auth_user_pass, and accelerate migration off the end-of-life 10.1.2r60p100 firmware or decommission affected appliances.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB