The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected…
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an attacker on the local network segment to execute arbitrary JavaScript code within the context of the WDU webpage. Full administrator level access to the device is possible. To initiate an exploit of this vulnerability, the victim must execute two actions: (1) view a specific URL served by the WDU, and (2) click an element on the rendered page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:1.4.6:*:*:*:*:*:*:* | 1.4.6 | Vulnerable | Garmin |
| cpe:2.3:h:garmin:empirbus_wireless_display_unit:v1:*:*:*:*:*:*:* | v1 | Running on | Garmin |
| cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:5.00:*:*:*:*:*:*:* | 5.00 | Vulnerable | Garmin |
| cpe:2.3:h:garmin:empirbus_wireless_display_unit:v2:*:*:*:*:*:*:* | v2 | Running on | Garmin |
- cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:1.4.6:*:*:*:*:*:*:* Versions 1.4.6 Vulnerable ·Garmin
- cpe:2.3:h:garmin:empirbus_wireless_display_unit:v1:*:*:*:*:*:*:* Versions v1 Running on ·Garmin
- cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:5.00:*:*:*:*:*:*:* Versions 5.00 Vulnerable ·Garmin
- cpe:2.3:h:garmin:empirbus_wireless_display_unit:v2:*:*:*:*:*:*:* Versions v2 Running on ·Garmin
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27852
- 2026-10-03 Alias added: GHSA-qcwv-872h-7hpj
More Garmin Empirbus Wireless Display Unit Firmware vulnerabilities
- TI-2025-20616 The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site… CVSS 3.1CRITICAL 9.3
- TI-2025-20615 The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink… CVSS 3.1HIGH 7.5
- TI-2025-20618 The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its… CVSS 3.1HIGH 7.3
Sources
- CVE-2025-27852 · CVE Program
- CVE-2025-27852 · NVD
- FIRST EPSS
- GHSA-qcwv-872h-7hpj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences