CVE-2026-90822

CriticalCVSS 9.8

Published: 17/09/2026(UTC)Updated: 17/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Summary

FatPipe MPVPN, WARP, and IPVPN appliances running end-of-life firmware 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the management interface can submit crafted input to the AuthFormServlet endpoint, allowing arbitrary commands to execute as root.

Risk Assessment

This vulnerability allows full device compromise by an unauthenticated attacker if the management interface is enabled and reachable. The risk is high because no authentication is required and commands run as root.

Recommendation

Restrict management access to trusted administrative networks and use WAN access control lists to limit access to trusted sources. Contact FatPipe Support to confirm the firmware version and upgrade to a current supported release.

Other vulnerabilities in FatPipe MPVPN/WARP/IPVPN

CVE-2026-90823Critical
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer.

Original NVD description (English source)

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface can submit crafted input to the AuthFormServlet endpoint, causing authentication data to be processed by a shell and allowing arbitrary commands to execute as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, [email protected], or +1 800-724-8521 (option 3).