The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the filesystem is enabled. This allows an attacker to retrieve arbitrary files from the device.
References
| Link | Resource |
|---|---|
| https://garmin.com | Product |
| https://www8.garmin.com/support/ch.jsp?product=010-02642-00 | Release Notes |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
02 Jun 2026, 18:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://garmin.com - Product | |
| References | () https://www8.garmin.com/support/ch.jsp?product=010-02642-00 - Release Notes | |
| CPE | cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:5.00:*:*:*:*:*:*:* cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:1.4.6:*:*:*:*:*:*:* cpe:2.3:h:garmin:empirbus_wireless_display_unit:v1:*:*:*:*:*:*:* cpe:2.3:h:garmin:empirbus_wireless_display_unit:v2:*:*:*:*:*:*:* |
|
| First Time |
Garmin empirbus Wireless Display Unit Firmware
Garmin empirbus Wireless Display Unit Garmin |
14 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-59 |
13 May 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-13 21:16
Updated : 2026-06-02 18:49
NVD link : CVE-2025-27850
Mitre link : CVE-2025-27850
CVE.ORG link : CVE-2025-27850
JSON object : View
Products Affected
garmin
- empirbus_wireless_display_unit
- empirbus_wireless_display_unit_firmware
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')