CVE-2026-90823

Name of the Vulnerable Software and Affected Versions FatPipe MPVPN version 10.1.2r60p100 FatPipe WARP version 10.1.2r60p100 FatPipe IPVPN version 10.1.2r60p100

Description A stack-based buffer overflow exists in the /usr/sbin/auth user pass function. An unauthenticated remote attacker with access to the management interface can send a crafted authentication request that triggers an unchecked copy into a fixed-size stack buffer, potentially leading to arbitrary code execution with root privileges. The management interface is disabled by default and requires manual activation by the user to be accessible.

Recommendations Upgrade version 10.1.2r60p100 to a current supported release. Restrict management access to trusted administrative networks. Use WAN access control lists to limit access to trusted sources.