High severity · published Jan 22, 2025
CVE-2025-0651
Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.
User with a low system privileges can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user.
This issue affects WARP: before 2024.12.492.0.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Warp · Cloudflare
before 2024.12.492.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0651
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0651
Product
https://developers.cloudflare.com/warp-client/
More from Warp
9.8
CVE-2022-3320
Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command
8.8
CVE-2022-3512
Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
8.5
CVE-2022-3337
Lock WARP switch bypass by removing VPN profile on iOS mobile client
8.2
CVE-2022-3321
Lock WARP switch feature bypass on WARP mobile client for iOS
8.0
CVE-2022-4428
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the…