TI-2023-00619 Aliases CVE-2023-0654

Spoofing User's Activity Loads in WARP Mobile Client (Android)

LOW 18CWE-1021Published 2023-08-29 · Updated 2024-09-30

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1021.

Summary

Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker's app.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00217 12th percentileScored 2026-11-07

Fix Fixed WARP Client (Cloudflare): 6.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cloudflare	WARP Client	before 6.29	6.29	Patch available	CNA

WARP Client VendorCloudflare Affected before 6.29 Fixed in 6.29 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cloudflare:warp::::::android::*	before 6.29	Vulnerable	Cloudflare

cpe:2.3:a:cloudflare:warp:*:*:*:*:*:android:*:* Versions before 6.29 Vulnerable ·Cloudflare

Remediation

Fix · CNA WARP Client (Cloudflare) Fixed in 6.29

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-08-29
Cloudflare WARP Client 6.29
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-00226 Injecting Activity Loads in WARP Mobile ClientPriority LOW 24
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-0654

References

Advisory 1

https://github.com/cloudflare/advisories/security/advisories/GHSA-5r97-pqv6-xpx7

Other 1

https://developers.cloudflare.com/warp-client/

TI-2022-04046 support_uri validation missing in WARP client for Windows CVSS 3.1HIGH 8.9
TI-2022-03068 Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command CVSS 3.1CRITICAL 9.8
TI-2023-01749 Remote access to warp-svc.exe in Cloudflare WARP CVSS 3.1HIGH 7.3
TI-2022-03240 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command CVSS 3.1HIGH 8.8
TI-2023-02579 Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client CVSS 3.1HIGH 7.4
TI-2023-01335 Local Privilege Escalation Vulnerability in WARP's MSI Installer CVSS 3.1HIGH 7.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences