CVE-2023-35838: 
Cisco AnyConnect Secure Client vulnerability analysis and mitigation

The WireGuard client 0.5.3 on Windows contains a security vulnerability (CVE-2023-35838) where it insecurely configures the operating system and firewall such that traffic to a local network using non-RFC1918 IP addresses is blocked. This vulnerability is part of a broader set of attacks known as TunnelCrack, which allows adversaries to manipulate VPN client traffic. The vulnerability was discovered by researchers from KU Leuven, NYU, and NYU Abu Dhabi, and was publicly disclosed on August 8, 2023 (TunnelCrack Details).

The vulnerability is classified as a LocalNet attack that results in the blocking of traffic, with a CVSS v3.1 base score of 5.7 (Medium) and vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The attack exploits how VPN clients handle local network access features, allowing an adversary to manipulate the victim's routing table. The vulnerability is tracked under CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) (NVD Details).

When exploited, this vulnerability allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services, even while the VPN is enabled. This can result in denial of service to specific network resources and compromise the expected protection provided by the VPN (TunnelCrack Details).

For Windows users of WireGuard 0.5.3, the primary mitigation is to disable local network access in VPN client settings where possible. Users should ensure their devices are up-to-date and maintain general security best practices such as using HTTPS for sensitive communications (TunnelCrack Details).