← Back

CVE-2025-27853

nvd nist
Published: May 13, 2026Modified: Jun 2, 2026

JSON object

Loading...
7.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitability: 3.9 / Impact: 3.4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication with the client within the client's browser. The WebSockets used to communicate with the WDU server do not enforce any authentication. An attacker may bypass all authentication mechanisms by directly utilizing the remote APIs available on the websocket.

Affected (2)

Garmin
1 product
Empirbus Wireless Display Unit Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Empirbus Wireless Display Unit Firmware
Version 1.4.6
Running on/withPlatform Versions
Garmin
Empirbus Wireless Display Unit
Version v1
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Empirbus Wireless Display Unit Firmware
Version 5.00
Running on/withPlatform Versions
Garmin
Empirbus Wireless Display Unit
Version v2

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: cve@mitre.org
Product
Source: cve@mitre.org
Release Notes

Timeline

No history available yet.