PT-2026-40795 · Garmin · Empirbus Wireless Display Unit Firmware

CVE-2025-27850 · Published 2026-05-13 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Garmin WDU version 1.4.6 Garmin WDU version 5.0

Description The locally served web site allows a symlink attack, which occurs when a system follows a symbolic link (a file that points to another file or directory) to access locations outside the intended folder. By uploading a malicious graphics package containing symlinks, an attacker can cause the web server to follow these links and retrieve arbitrary files from the device because there are no mechanisms to restrict link targets to a specific area of the filesystem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-27850

Affected Products

Empirbus Wireless Display Unit Firmware

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-27850 · Security Note
• https://garmin.com · Note
• https://www8.garmin.com/support/ch.jsp?product=010-02642-00 · Note
• https://t.me/cveNotify/165690 · Telegram Post