FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface can submit crafted input to the AuthFormServlet endpoint, causing authentication data to be processed by a shell …

The management interface on FatPipe MPVPN, WARP, and IPVPN devices running the old 10.1.2r60p100 firmware can be tricked into running any code an attacker.

The MPVPN, WARP and IPVPN appliances that are still running the old 10.1.2r60p100 firmware let an unauthenticated attacker send specially crafted data to.

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code …