The U.S. Federal Bureau of Investigation (FBI) has issued an alert stating that for months, an unknown threat actor has been exploiting an input validation zero-day vulnerability within the web management interface of FatPipe WARP, MPVPN, and IPVPN router clustering and VPN load-balancing networking devices. The FBI identified the activity in May 2021, after the attacker first gained a foothold within the infrastructure, but it is possible the attacker could have been exploiting the weakness for longer. When exploited, this vulnerability allows attackers to upload arbitrary files remotely, permitting them to elevate their privileges, pilfer data, or execute malware. Once the initial foothold is obtained, this flaw serves as an attack vector from which other associated infrastructure can be compromised. This vulnerability allows the threat actor to upload files to any location on the file system of a device connected to a compromised MPVPN networking device. The FBI has stated in the alert that the vulnerability has been leveraged to strike additional U.S. government infrastructure. Although a patch to mitigate the flaw has not yet been released, FatPipe states that the vulnerability, “can be mitigated by disabling UI and SSH access on the WAN interface or configuring Access Lists to permit access only from trusted sources.” CTAPT will continue to monitor this matter, and an update may be released when the flaw has been officially patched.