Vulnerabilities

TI-2025-20618 CVE-2025-27853 · GHSA-cvgr-crrw-gcqx

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its…

LOW 38

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00297 Published 2026-05-13 No fix listed CWE-306

TI-2025-20617 CVE-2025-27852 · GHSA-qcwv-872h-7hpj

LOW 22

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack.

CVSS 3.1MEDIUM 5.0 Local No auth User interaction EPSS 0.0014 Published 2026-05-13 No fix listed CWE-79

TI-2025-20616 CVE-2025-27851 · GHSA-frpq-7mr9-hx8p

MEDIUM 41

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00145 Published 2026-05-13 No fix listed CWE-352

TI-2025-20615 CVE-2025-27850 · GHSA-rp9w-778v-4h8m

LOW 39

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00387 Published 2026-05-13 No fix listed CWE-59