CVE-2022-3321 Lock WARP switch feature bypass on WARP mobile client for iOS

It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in...

CVE-2022-3512 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

CVE-2022-3512

CVE-2022-3512 affects Cloudflare WARP by allowing a user to disconnect the WARP client and bypass the Lock WARP switch using the warp-cli add-trusted-ssid command, enabling Zero Trust policies not to be enforced on the endpoint. The available sources consistently describe the bypass vector and it...

CVE-2022-3512 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

CVE-2022-3512

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare WARP Zero Trust Secure Web Gateway, which stems from an attacker's ability to disconnect the WARP client and bypass the "lock WAR...

CVE-2022-3320: Missing Authorization

It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restrictions on a Zero Trust enrolled...

CVE-2022-3321: Missing Authorization

It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connectivity from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare WARP Zero Trust Secure Web Gateway, which stems from the fact that an attacker can bypass its configuration policy by using the...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connectivity from the American company Cloudflare. Cloudflare WARP suffers from a security vulnerability that stems from the ability for a user to remove a VPN profile from the WARP mobile client on the iOS platform, despite the Lo...

CVE-2022-3322: Missing Authorization

Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action...

PT-2022-22585 · Warp · Warp

Name of the Vulnerable Software and Affected Versions: WARP affected versions not specified Description: The issue allows a user to disconnect the WARP client and bypass the "Lock WARP switch" feature by using the warp-cli command "add-trusted-ssid". This results in Zero Trust policies not being...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connectivity from Cloudflare, Inc. A security vulnerability exists in Cloudflare WARP, which can be exploited to bypass the lock WARP switch feature on the WARP iOS mobile client by enabling both the "Disable Cellular Networks" and...

PT-2022-21746 · Cloudflare · Cloudflare Warp

Name of the Vulnerable Software and Affected Versions: Cloudflare WARP iOS mobile client affected versions not specified Description: The issue allowed users to bypass the Lock WARP switch feature on the WARP iOS mobile client. This was possible by enabling both "Disable for cellular networks" an...

PT-2022-21737 · Unknown · Warp Client

Name of the Vulnerable Software and Affected Versions: WARP Client affected versions not specified Description: The issue allows bypassing policies configured for Zero Trust Secure Web Gateway. This can be achieved by using the warp-cli command with the set-custom-endpoint subcommand and specifyi...

PT-2022-21776 · Cloudflare · Cloudflare Warp

Name of the Vulnerable Software and Affected Versions: Cloudflare WARP mobile client affected versions not specified Description: The issue allowed a user to delete a VPN profile from the WARP mobile client on the iOS platform, despite the Lock WARP switch feature being enabled on the Zero Trust...

Secure your endpoints with Transparity and Microsoft

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Endpoint protection platforms EPPs are dead and no longer sufficient to protect your organization, right? Wrong. When it comes to cybersecurity, the ability to normalize and correlat...

Secure your endpoints with Transparity and Microsoft

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Endpoint protection platforms EPPs are dead and no longer sufficient to protect your organization, right? Wrong. When it comes to cybersecurity, the ability to normalize and correlat...

Financial Services Malware Just Won’t Die: What to Do About It?

The continued reemergence of the Emotet malware is keeping cybersecurity professionals on their toes. Zero Trust solutions are here to help...

CSO perspective: Why a strong IAM strategy is key to an organization’s cybersecurity approach

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Alissa “Dr. Jay”...