CVE-2023-35838
MediumCVSS 5.7Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
WireGuard client version 0.5.3 on Windows insecurely configures the operating system and firewall, leading to the blocking of traffic to a local network using non-RFC1918 IP addresses. This allows an adversary to trick the victim into blocking IP traffic to selected addresses and services even while the VPN is enabled.
Risk Assessment
The organization may be exposed to attacks that block access to critical services and IP addresses, potentially disrupting operations. Users may be misled about the security of their VPN connection.
Recommendation
It is recommended to update the WireGuard client to the latest version and review the firewall and operating system configuration to ensure proper traffic management. A security audit should also be conducted to identify potential vulnerabilities.
Original NVD description (English source)
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in the blocking of traffic" rather than to only WireGuard.