CVE-2022-3321 MEDIUM

CVE-2022-3321: Lock WARP switch feature bypass on WARP mobile client for iOS

Vendor Cloudflare

Product WARP

Weakness CWE-862 · Missing authorization

Published October 28, 2022

Last update May 8, 2025

View on NVD All CVEs

CVSS base score

6.7/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L

What the vulnerability does

01Description

It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.

Key dates

02Disclosure timeline

October 28, 2022 CVE published

May 8, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3321 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2026-57339 WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability CVE-2026-39448 WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability CVE-2026-12472 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters CVE-2026-57340 WordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability CVE-2026-58448 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API