TI-2023-01749 Aliases CVE-2023-1862

Remote access to warp-svc.exe in Cloudflare WARP

LOW 39CWE-284Published 2023-06-20 · Updated 2024-12-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and disconnect commands, as well as obtaining network diagnostics and application configuration from the target's device. It is important to note that in order to exploit this, a set of requirements would need to be met, such as the target's device must've been reachable on port 445, allowed authentication with NULL sessions or otherwise having knowledge of the target's credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00754 55th percentileScored 2026-11-07

Fix Fixed WARP Client (Cloudflare): 2023.3.381.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cloudflare	WARP Client	before 2023.3.381.0	2023.3.381.0	Patch available	CNA

WARP Client VendorCloudflare Affected before 2023.3.381.0 Fixed in 2023.3.381.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cloudflare:warp::::::windows::*	up to 2023.3.381.0	Vulnerable	Cloudflare

cpe:2.3:a:cloudflare:warp:*:*:*:*:*:windows:*:* Versions up to 2023.3.381.0 Vulnerable ·Cloudflare

Remediation

Fix · CNA WARP Client (Cloudflare) Fixed in 2023.3.381.0

Timeline

2026-10-02 Threatist record created from CVE-2023-1862

References

Advisory 1

https://github.com/cloudflare/advisories/security/advisories/GHSA-q55r-53c8-5642

Other 2

TI-2022-04046 support_uri validation missing in WARP client for Windows CVSS 3.1HIGH 8.9
TI-2022-03068 Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command CVSS 3.1CRITICAL 9.8
TI-2022-03240 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command CVSS 3.1HIGH 8.8
TI-2023-02579 Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client CVSS 3.1HIGH 7.4
TI-2023-01335 Local Privilege Escalation Vulnerability in WARP's MSI Installer CVSS 3.1HIGH 7.8
TI-2023-00618 Local Privilege Escalation in Cloudflare WARP Installer (Windows) CVSS 3.1HIGH 7.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences