FBI: An APT abused a zero-day in FatPipe VPNs for six months

guest · Nov 18, 2021

FBI: An APT abused a zero-day in FatPipe VPNs for six months
November 17, 2021
https://therecord.media/fbi-an-apt-abused-a-zero-day-in-fatpipe-vpns-for-six-months/

The US Federal Bureau of Investigation said it discovered an advanced persistent threat (APT) abusing a zero-day vulnerability in FatPipe networking devices as a way to breach companies and gain access to their internal networks.

“As of November 2021, FBI forensic analysis indicated exploitation of a 0-day vulnerability in the FatPipe MPVPN device software going back to at least May 2021,” the agency said in a flash security alert sent out on Tuesday.
The FBI said the vulnerability allowed the hacking group to exploit a file upload function in the device’s firmware and install a webshell with root access.
Click to expand...

The FBI said it spotted the hackers abusing the zero-day only against FatPipe MPVPN devices, but the vulnerability also impacted other products, such as IPVPN and WARP.
Patch released yesterday, November 16
The FBI said the zero-day it discovered during its investigation does not currently have its own CVE identifier.

FatPipe has released a patch and additional information via an internal security advisory tracked as FPSA006. The company said the zero-day could be exploited to overwrite an affected device’s configuration file, which allows attackers to take full control of unpatched systems.
Click to expand...

Log in or Sign up

FBI: An APT abused a zero-day in FatPipe VPNs for six months

guest Guest

Log in or Sign up

FBI: An APT abused a zero-day in FatPipe VPNs for six months

guest Guest

Useful Searches