CVE-2022-3337 MEDIUM

CVE-2022-3337: Lock WARP switch bypass by removing VPN profile on iOS mobile client

Vendor Cloudflare

Product WARP

Weakness CWE-862 · Missing authorization

Published October 28, 2022

Last update May 6, 2025

View on NVD All CVEs

CVSS base score

6.7/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L

What the vulnerability does

01Description

It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.

Key dates

02Disclosure timeline

October 28, 2022 CVE published

May 6, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3337 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2024-34803 WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerability CVE-2025-5919 Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification CVE-2023-26002 WordPress 6Storage Rentals <= 2.19.5 - Broken Access Control Vulnerability CVE-2024-50428 WordPress Multi Step Form plugin <= 1.7.21 - Broken Access Control vulnerability CVE-2025-65112 PubNet Critical Authentication Bypass Allows Unauthenticated Package Upload and Identity Spoofing