Description

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-17T12:18:28.843Z",
  "pubdate": "2026-09-17T12:18:28.843Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in FatPipe MPVPN, WARP, and IPVPN appliances running firmware version 10.1.2r60p100. This security flaw resides within the /usr/sbin/auth_user_pass binary, which is responsible for handling authentication processes.\nThe vulnerability allows an unauthenticated, remote attacker to execute arbitrary code with root-level privileges on the target appliance. Successful exploitation is contingent upon the management interface being enabled; however, once accessible, the lack of input validation in the authentication handling routine creates a high-risk attack vector.\nThe primary risk implication is a total compromise of the affected device, potentially leading to unauthorized data interception, network traffic redirection, or further exploitation of the internal network infrastructure. As the affected firmware version is end-of-life, the vulnerability presents a significant operational risk for organizations that have not migrated to supported releases. Attackers do not require pre-existing authentication to trigger the overflow, making it an attractive target for remote malicious actors capable of reaching the management interface.",
  "technicalDetails": "The vulnerability is characterized as a stack-based buffer overflow located in the /usr/sbin/auth_user_pass binary. This component fails to implement adequate bounds checking when processing input data during the authentication handshake process. Specifically, the application performs an unchecked copy operation of user-supplied authentication credentials into a fixed-size stack-allocated memory buffer.\nThe attack flow begins when an attacker sends a specially crafted, oversized authentication request to the exposed management interface. Because the code fails to validate the length of the input data against the capacity of the target buffer, the input data exceeds the allocated stack space, overwriting adjacent memory regions. This memory corruption allows the attacker to manipulate the execution flow of the application by overwriting critical data such as the saved return pointer or function pointers stored on the stack.\nBy precisely crafting the payload, an attacker can hijack the program execution path to redirect control to shellcode injected within the malicious authentication request. Given that the /usr/sbin/auth_user_pass binary operates with root privileges, any successful redirection of the control flow results in arbitrary code execution in the context of the root user. This provides the attacker with full administrative control over the appliance's underlying operating system.\nThe exploitation process is simplified for the attacker because the target function does not utilize modern exploit mitigations, such as stack canaries or Address Space Layout Randomization (ASLR), that might otherwise disrupt the execution of the exploit payload. The impact post-exploitation includes the ability to bypass security controls, maintain persistence on the device, and potentially pivot into the internal network segments protected by the FatPipe appliance.\nThe affected firmware version is 10.1.2r60p100, which has reached end-of-life status. The primary requirement for exploitation is connectivity to the management interface. While the interface is disabled by default, it may be active due to previous administrative configuration, thereby exposing the system to network-based attacks from any source capable of reaching the management port."
}