CVE-2022-3321

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Cloudflare	WARP	< 6.14

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78Third Party Advisory
https://github.com/cloudflare/advisories/security/advisories/GHSA-4463-5p9m-3c78Third Party Advisory

Timeline

Published: Oct 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-332107.8Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large CVE-2022-332119.8memory corruption in modem due to improper check while calculating size of serialized CoAP message CVE-2022-332138.8Memory corruption in modem due to buffer overflow while processing a PPP packet CVE-2022-332147.0Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon C CVE-2022-332165.5Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file.CVE-2022-332177.8Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication with a compromised kern CVE-2022-332187.8Memory corruption in Automotive due to improper input validation.CVE-2022-332197.8Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.CVE-2022-33227.5Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. D CVE-2022-332205.5Information disclosure in Automotive multimedia due to buffer over-read.CVE-2022-332215.5Information disclosure in Trusted Execution Environment due to buffer over-read while processing metadata verification requests.CVE-2022-332227.5Information disclosure due to buffer over-read while parsing DNS response packets in Modem.