The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker.
References
| Link | Resource |
|---|---|
| https://garmin.com | Product |
| https://www8.garmin.com/support/ch.jsp?product=010-02642-00 | Release Notes |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
02 Jun 2026, 19:04
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://garmin.com - Product | |
| References | () https://www8.garmin.com/support/ch.jsp?product=010-02642-00 - Release Notes | |
| CPE | cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:5.00:*:*:*:*:*:*:* cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:1.4.6:*:*:*:*:*:*:* cpe:2.3:h:garmin:empirbus_wireless_display_unit:v1:*:*:*:*:*:*:* cpe:2.3:h:garmin:empirbus_wireless_display_unit:v2:*:*:*:*:*:*:* |
|
| First Time |
Garmin empirbus Wireless Display Unit Firmware
Garmin empirbus Wireless Display Unit Garmin |
14 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.3 |
| CWE | CWE-352 |
13 May 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-13 21:16
Updated : 2026-06-02 19:04
NVD link : CVE-2025-27851
Mitre link : CVE-2025-27851
CVE.ORG link : CVE-2025-27851
JSON object : View
Products Affected
garmin
- empirbus_wireless_display_unit
- empirbus_wireless_display_unit_firmware
CWE
CWE-352
Cross-Site Request Forgery (CSRF)