Remote access to warp-svc.exe in Cloudflare WARP

CVE-2023-1862

What is CVE-2023-1862?

An access control vulnerability in the Cloudflare WARP client for Windows, up to version 2023.3.381.0, allows remote attackers to access the warp-svc.exe binary via an IPC Named Pipe. This can lead to unauthorized execution of connect and disconnect commands for the WARP service, as well as exposure of sensitive network diagnostics and configuration information from the targeted device. Successful exploitation requires specific conditions, such as the device being accessible on port 445 and either allowing NULL session authentication or having leaked credentials.

References