CVE-2026-90823: FatPipe MPVPN Buffer Overflow Vulnerability

CVE-2026-90823 Overview

CVE-2026-90823 is a stack-based buffer overflow [CWE-121] in the /usr/sbin/auth_user_pass binary shipped with FatPipe MPVPN, WARP, and IPVPN appliances running end-of-life firmware version 10.1.2r60p100. An unauthenticated remote attacker with network access to the management interface can submit a crafted authentication request that triggers an unchecked copy into a fixed-size stack buffer. Successful exploitation may result in arbitrary code execution as root on the affected appliance.

The management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable over the network.

Critical Impact
Unauthenticated remote code execution as root on FatPipe MPVPN, WARP, and IPVPN appliances when the management interface is exposed.

Affected Products

FatPipe MPVPN appliances running firmware 10.1.2r60p100
FatPipe WARP appliances running firmware 10.1.2r60p100
FatPipe IPVPN appliances running firmware 10.1.2r60p100

Discovery Timeline

2026-09-17 - CVE-2026-90823 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-90823

Vulnerability Analysis

The flaw resides in the auth_user_pass binary, a setuid-style authentication helper located at /usr/sbin/auth_user_pass on affected FatPipe appliances. The binary parses authentication input received through the management interface and copies attacker-controlled data into a fixed-size buffer on the stack without validating the input length. An attacker who can reach the management interface can send a crafted authentication request that overflows the stack buffer, corrupting the saved return address and adjacent stack frame data.

Because the vulnerable code path executes prior to authentication, no valid credentials are required. Successful exploitation can redirect execution flow and run attacker-supplied instructions in the context of the root user, providing full control over the appliance and any traffic transiting it.

Root Cause

The root cause is missing bounds checking during a memory copy operation in /usr/sbin/auth_user_pass. Input received from the network-facing authentication handler is copied into a stack-allocated buffer without verifying that the source length fits within the destination. This is a classic stack-based buffer overflow pattern classified as [CWE-121].

Attack Vector

Exploitation requires network reachability to the affected management interface. The interface is disabled by default and must be enabled by the customer. When it is exposed, an attacker crafts an authentication request containing an oversized field that reaches the vulnerable copy routine. No user interaction and no prior authentication are required. Details of the vulnerable code path are described in the Securifera Security Advisories.

Detection Methods for CVE-2026-90823

Indicators of Compromise

Unexpected crashes, restarts, or core dumps of the auth_user_pass process on FatPipe MPVPN, WARP, or IPVPN appliances
Authentication requests to the management interface containing abnormally long username, password, or credential fields
New or unexplained outbound connections initiated by the appliance following inbound management-interface traffic
Modifications to system binaries, /etc configuration files, or startup scripts on the appliance

Detection Strategies

Inspect network telemetry for unauthenticated connections to the FatPipe management interface from sources outside trusted administrative networks
Review appliance logs for repeated failed or malformed authentication attempts preceding process crashes
Alert on any interactive shell activity or new processes spawned as root on affected appliances

Monitoring Recommendations

Forward appliance syslog and authentication logs to a central logging platform for retention and correlation
Monitor for changes to firmware version strings and unexpected package or file modifications on the appliance
Track ingress traffic to management interfaces and generate alerts when new sources appear

How to Mitigate CVE-2026-90823

Immediate Actions Required

Confirm firmware version by contacting FatPipe Support at support@fatpipeinc.com or +1 800-724-8521 (option 3)
Disable the management interface if it is not required for operations
Restrict management access to trusted administrative networks using WAN access control lists
Upgrade to a current supported release through FatPipe Support because firmware 10.1.2r60p100 is end-of-life

Patch Information

Firmware version 10.1.2r60p100 is end-of-life and does not receive security patches. Customers must contact FatPipe Support to identify and migrate to a currently supported firmware release. Refer to FatPipe Support Resources for upgrade assistance.

Workarounds

Keep the management interface disabled unless required, since it is off by default
Apply WAN access control lists to restrict the management interface to specific trusted administrative source IP ranges
Place appliances behind a jump host or bastion so the management interface is not directly exposed to untrusted networks
Segment appliance management traffic onto a dedicated out-of-band network isolated from user and internet-facing segments

bash

# Example: restrict management access using WAN ACLs (concept)
# Permit only trusted admin subnet, deny all other sources
permit tcp 10.10.0.0/24 any eq <mgmt-port>
deny   tcp any any eq <mgmt-port>