CVE-2026-90823
Quick assessment
Affected
FatPipe Networks MPVPN
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
运行已停止支持（end-of-life）的 10.1.2r60p100 固件版本的 FatPipe MPVPN、WARP 和 IPVPN 设备存在位于 /usr/sbin/auth_user_pass 中的基于栈的缓冲区溢出漏洞。未认证的远程攻击者若能访问受影响的管理接口，可提交一个特制的身份验证请求，触发将数据复制到固定大小栈缓冲区时缺乏边界检查的操作，从而可能导致以 root 权限执行任意代码。 受影响的管理接口默认处于禁用状态，需由客户明确启用后该端点才可被访问。FatPipe 建议将管理访问限制在受信任的管
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90823
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root.
The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources.
Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| FatPipe Networks | MPVPN | 10.1.2r60p100 | - |
|
| FatPipe Networks | WARP | 10.1.2r60p100 | - |
|
| FatPipe Networks | IPVPN | 10.1.2r60p100 | - |
|
II. Public POCs for CVE-2026-90823
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90823
请登录查看更多情报信息。
Vendor Pages for CVE-2026-90823 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-90823
No comments yet