Denial of service in WireGuard client for Windows
| Risk | Medium |
| Patch available | NO |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-35838 |
| CWE-ID | CWE-610 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
WireGuard for Windows Client/Desktop applications / Other client software |
| Vendor | WireGuard |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Externally Controlled Reference to a Resource in Another Sphere
EUVDB-ID: #VU82576
Risk: Medium
CVSSv3.1: 4 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:U/RC:C]
CVE-ID: CVE-2023-35838
CWE-ID:
CWE-610 - Externally Controlled Reference to a Resource in Another Sphere
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to block access to certain resources.
The vulnerability exists due to the way WireGuard handles non-RFC1918 IP addresses. A remote attacker can trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsWireGuard for Windows: 0.0.1 - 0.5.3
External linkshttp://tunnelcrack.mathyvanhoef.com/details.html
http://wireguard.com
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
