TI-2023-03500 Aliases CVE-2023-3747

Insufficient Validation on Override Codes for Always-Enabled WARP Mode

LOW 24CWE-602Published 2023-09-07 · Updated 2024-09-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server side validation, an attacker with local access to the device, could extend the maximum allowed disconnected time of WARP client granted by an override code by changing the date & time on the local device where WARP is running.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00198 9th percentileScored 2026-11-07

Fix Fixed WARP Client (Cloudflare): 6.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cloudflare	WARP Client	before 6.29	6.29	Patch available	CNA

WARP Client VendorCloudflare Affected before 6.29 Fixed in 6.29 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cloudflare:warp:6.29:::::android::	6.29	Vulnerable	Cloudflare

cpe:2.3:a:cloudflare:warp:6.29:*:*:*:*:android:*:* Versions 6.29 Vulnerable ·Cloudflare

Remediation

Fix · CNA WARP Client (Cloudflare) Fixed in 6.29

Timeline

2026-10-02 Threatist record created from CVE-2023-3747

References

Other 2

TI-2022-04046 support_uri validation missing in WARP client for Windows CVSS 3.1HIGH 8.9
TI-2022-03068 Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command CVSS 3.1CRITICAL 9.8
TI-2023-01749 Remote access to warp-svc.exe in Cloudflare WARP CVSS 3.1HIGH 7.3
TI-2022-03240 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command CVSS 3.1HIGH 8.8
TI-2023-02579 Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client CVSS 3.1HIGH 7.4
TI-2023-01335 Local Privilege Escalation Vulnerability in WARP's MSI Installer CVSS 3.1HIGH 7.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences