CVE-2025-27851 — CRITICAL (9.3)

Vulnerability Description

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker.

CVSS Score

9.3

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Garmin	Empirbus Wireless Display Unit Firmware	1.4.6
Garmin	Empirbus Wireless Display Unit	v1

Related Weaknesses (CWE)

CWE-352

References

https://garmin.comProduct
https://www8.garmin.com/support/ch.jsp?product=010-02642-00Release Notes

FAQ

What is CVE-2025-27851?

CVE-2025-27851 is a vulnerability with a CVSS score of 9.3 (CRITICAL). The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including ...

How severe is CVE-2025-27851?

CVE-2025-27851 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-27851?

Check the references section above for vendor advisories and patch information. Affected products include: Garmin Empirbus Wireless Display Unit Firmware, Garmin Empirbus Wireless Display Unit.