CVE-2023-35838

Katalog CVE

CVSS 5.7 · Medium EPSS 0,69%

Kerentanan Externally Controlled Reference to a Resource in Another Sphere pada wireguard. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in the blocking of traffic" rather than to only WireGuard.

Rincian

Terbit di NVD

9 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://tunnelcrack.mathyvanhoef.com/details.html exploit · advisory pihak ketiga
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015
• https://wireguard.com product