Cloudflare Warp
19 CVEs affecting Cloudflare Warp. Latest disclosed: 2025-01-22. Critical: 0, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4428 | High | 8.9 | 2023-01-11 | support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitra… |
CVE-2022-2225 | High | 8.1 | 2022-07-26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security po… |
CVE-2023-2754 | High | 7.4 | 2023-08-03 | The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a… |
CVE-2023-1862 | High | 7.3 | 2023-06-20 | Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access con… |
CVE-2025-0651 | High | 7.1 | 2025-01-22 | Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of sym… |
CVE-2023-0652 | High | 7.0 | 2023-04-06 | Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0… |
CVE-2023-1412 | High | 7.0 | 2023-04-05 | An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform p… |
CVE-2022-3512 | Medium | 6.7 | 2022-10-28 | Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies… |
CVE-2022-3337 | Medium | 6.7 | 2022-10-28 | It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/clou… |
CVE-2022-3322 | Medium | 6.7 | 2022-10-28 | Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient… |
CVE-2022-3321 | Medium | 6.7 | 2022-10-28 | It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-… |
CVE-2022-3320 | Medium | 6.7 | 2022-10-28 | It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an… |
CVE-2022-2147 | Medium | 6.5 | 2022-06-23 | Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation… |
CVE-2022-2145 | Medium | 5.8 | 2022-06-28 | Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client… |
CVE-2023-3747 | Medium | 5.5 | 2023-09-07 | Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators… |
CVE-2022-4457 | Medium | 5.5 | 2023-01-11 | Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a… |
CVE-2020-35152 | Medium | 4.5 | 2021-02-03 | Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges… |
CVE-2023-0654 | Low | 3.9 | 2023-08-29 | Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious… |
CVE-2023-0238 | Low | 3.9 | 2023-08-29 | Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on… |