dbcve.org
WarpApplication · Cloudflare

CVE-2023-1862

HIGH · 7.3 CVSS v3.1 Published 2023-06-20
Fix available
A fix is available. Upgrade to after 2023.3.381.0 or later.
See remediation →
82/100
Remediation priority · High
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and disconnect commands, as well as obtaining network diagnostics and application configuration from the target's device. It is important to note that in order to exploit this, a set of requirements would need to be met, such as the target's device must've been reachable on port 445, allowed authentication with NULL sessions or otherwise having knowledge of the target's credentials.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Cloudflare WARP client for Windows (versions up to v2023.3.381.0) had insufficient access control on an IPC Named Pipe (warp-svc.exe). A remote attacker with network access to port 445 and valid credentials or NULL session authentication could trigger WARP connect/disconnect commands and exfiltrate network diagnostics and application configuration from the target device.

MitigationUpdate Cloudflare WARP client to a version newer than v2023.3.381.0 and block port 445 at the perimeter if SMB/NULL sessions are not required, or disable NULL session authentication per best practices.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
WarpApplication
Affected:<= 2023.3.381.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify if Cloudflare WARP is installed
    Open Programs and Features (appwiz.cpl) or check C:\Program Files\Cloudflare\WARP for the warp-svc.exe binary
    Affected if Cloudflare WARP client is present on the system
  2. Determine installed WARP version
    Right-click warp-svc.exe in C:\Program Files\Cloudflare\WARP, select Properties, then view the Details tab for the File version, or run: Get-Item 'C:\Program Files\Cloudflare\WARP\warp-svc.exe' | Select-Object VersionInfo
    Affected if Version shown is 2023.3.381.0 or lower (e.g., 2023.3.380.0, 2023.2.x, etc.)
  3. Verify SMB port 445 is exposed
    Run 'netstat -an | findstr :445' locally, or scan the machine from another system using: nmap -p 445 <targetIP>
    Affected if Port 445 is LISTENING or OPEN and accessible from network
  4. Confirm NULL session authentication is permitted
    Check registry key HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\RestrictNullSessAccess - if set to 0 or missing, NULL sessions are allowed
    Affected if RestrictNullSessAccess is set to 0 or does not exist (NULL sessions permitted)
  5. Test named pipe accessibility (if applicable)
    From a remote system with network access, attempt to access the pipe using: echo . | nc -w 3 <targetIP> 445, or use tools like enum4linux to probe for the warp-svc named pipe
    Affected if The remote system can reach port 445 and NULL sessions or valid credentials allow pipe interaction

User is affected if Cloudflare WARP version 2023.3.381.0 or lower is installed AND port 445 is accessible from the network with NULL session or valid credentials enabled, allowing unauthorized interaction with the warp-svc named pipe.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 2023.3.381.0
Interim mitigation

Update Cloudflare WARP client to a version newer than v2023.3.381.0 and block port 445 at the perimeter if SMB/NULL sessions are not required, or disable NULL session authentication per best practices.

Recommended fix Low confidence

Any Cloudflare WARP version released after 2023.3.381.0

  1. 1. Verify the current Cloudflare WARP client version installed on the Windows system by opening the WARP application and checking About/Preferences.
  2. 2. If the installed version is 2023.3.381.0 or lower, download the latest version of Cloudflare WARP from the official Cloudflare website or the Microsoft Store.
  3. 3. Uninstall the current WARP client through Windows Settings > Apps & Features.
  4. 4. Install the latest WARP client version (any release after 2023.3.381.0).
  5. 5. After installation, verify the new version number matches a release newer than 2023.3.381.0.
  6. 6. Confirm the warp-svc.exe service is running properly and test WARP connectivity.
Caveat Minimal risk; standard client update with no expected configuration changes required

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Warp Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing1.0 h
  • Review / QA1.0 h
6.0 hours of engineering $1,090
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,744.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-1862 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-1862 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data