Skip to content
OpenAdvisories
Medium · 6.7 CVE-2022-3337 EUVD-2022-42724

Lock WARP switch bypass by removing VPN profile on iOS mobile client

Published Oct 28, 2022 · Updated May 6, 2025 · Assigned by cloudflare

Description

It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch  feature
being enabled on Zero Trust Platform. This led to bypassing policies
and restrictions enforced for enrolled devices by the Zero Trust
platform.

Affected products

VendorProductAffectedFixed
Cloudflare WARP < 6.15 6.15

References