{"document":{"category":"csaf_vex","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE"}},"lang":"en-US","notes":[{"category":"legal_disclaimer","text":"All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).","title":"Legal Notice"},{"category":"other","text":"Worldwide","title":"Countries and Areas Deployed"},{"category":"other","text":"Information Technology","title":"Critical Infrastructure Sectors"},{"category":"summary","text":"FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon and a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer or submit crafted input to the AuthFormServlet endpoint, both resulting in allowing arbitrary code execution as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources.\n\n","title":"Risk Evaluation"},{"category":"general","text":"Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).","title":"Recommended Practices"},{"category":"other","text":"United States","title":"Company Headquarters Location"}],"publisher":{"category":"coordinator","contact_details":"https://www.cisa.gov/report","issuing_authority":"CISA","name":"CISA","namespace":"https://www.cisa.gov/"},"references":[{"category":"self","summary":"Vulnerability Advisory VA-26-260-01 CSAF","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-260-01.json"}],"title":"FatPipe software multiple vulnerabilities","tracking":{"current_release_date":"2026-09-17T14:33:49Z","generator":{"engine":{"name":"VINCE-NT","version":"1.15.0+build.129"}},"id":"VA-26-260-01","initial_release_date":"2026-09-17T14:33:49Z","revision_history":[{"date":"2026-09-17T14:33:49Z","number":"1.0.0","summary":"Initial publication"}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"10.1.2r60p100","product":{"name":"FatPipe Networks IPVPN 10.1.2r60p100","product_id":"CSAFPID-0001"}}],"category":"product_name","name":"IPVPN"},{"branches":[{"category":"product_version","name":"10.1.2r60p100","product":{"name":"FatPipe Networks IPVPN 10.1.2r60p100","product_id":"CSAFPID-0002"}}],"category":"product_name","name":"IPVPN"},{"branches":[{"category":"product_version","name":"10.1.2r60p100","product":{"name":"FatPipe Networks MPVPN 10.1.2r60p100","product_id":"CSAFPID-0003"}}],"category":"product_name","name":"MPVPN"},{"branches":[{"category":"product_version","name":"10.1.2r60p100","product":{"name":"FatPipe Networks MPVPN 10.1.2r60p100","product_id":"CSAFPID-0004"}}],"category":"product_name","name":"MPVPN"},{"branches":[{"category":"product_version","name":"10.1.2r60p100","product":{"name":"FatPipe Networks WARP 10.1.2r60p100","product_id":"CSAFPID-0005"}}],"category":"product_name","name":"WARP"},{"branches":[{"category":"product_version","name":"10.1.2r60p100","product":{"name":"FatPipe Networks WARP 10.1.2r60p100","product_id":"CSAFPID-0006"}}],"category":"product_name","name":"WARP"}],"category":"vendor","name":"FatPipe Networks"}]},"vulnerabilities":[{"acknowledgments":[{"names":["Ryan Wincey"],"organization":"@rwincey, Securifera"}],"cve":"CVE-2026-90822","cwe":{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},"notes":[{"category":"summary","text":"FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface can submit crafted input to the AuthFormServlet endpoint, causing authentication data to be processed by a shell and allowing arbitrary commands to execute as root.","title":"Description"},{"category":"details","text":"SSVCv2/E:N/A:Y/T:T/2026-09-17T18:10:21Z/","title":"SSVC"}],"product_status":{"known_affected":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0005"]},"references":[{"category":"external","summary":"www.securifera.com","url":"https://www.securifera.com/advisories/"},{"category":"external","summary":"www.fatpipeinc.com","url":"https://www.fatpipeinc.com/support/support"}],"release_date":"2026-09-17T00:00:00Z","remediations":[{"category":"no_fix_planned","details":"Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).","product_ids":["CSAFPID-0001"]},{"category":"no_fix_planned","details":"Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).","product_ids":["CSAFPID-0003"]},{"category":"no_fix_planned","details":"Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).","product_ids":["CSAFPID-0005"]}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0005"]}],"title":"FatPipe software OS command injection"},{"acknowledgments":[{"names":["Ryan Wincey"],"organization":"@rwincey, Securifera"}],"cve":"CVE-2026-90823","cwe":{"id":"CWE-121","name":"Stack-based Buffer Overflow"},"notes":[{"category":"summary","text":"FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root.","title":"Description"},{"category":"details","text":"SSVCv2/E:N/A:Y/T:T/2026-09-17T18:10:31Z/","title":"SSVC"}],"product_status":{"known_affected":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0005"]},"references":[{"category":"external","summary":"www.securifera.com","url":"https://www.securifera.com/advisories/"},{"category":"external","summary":"www.fatpipeinc.com","url":"https://www.fatpipeinc.com/support/support"}],"release_date":"2026-09-17T00:00:00Z","remediations":[{"category":"no_fix_planned","details":"Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).","product_ids":["CSAFPID-0001"]},{"category":"no_fix_planned","details":"Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).","product_ids":["CSAFPID-0003"]},{"category":"no_fix_planned","details":"Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).","product_ids":["CSAFPID-0005"]}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-0001","CSAFPID-0003","CSAFPID-0005"]}],"title":"FatPipe software stack-based buffer overflow"}]}