PT-2026-40796 · Garmin · Empirbus Wireless Display Unit Firmware

Published 2026-05-13 · Updated 2026-06-02 · CVE-2025-27851

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Garmin WDU version 1.4.6 Garmin WDU version 5.0

Description The locally served web site allows a cross-site origin WebSocket hijacking attack. The system utilizes WebSockets to manage settings, including administrative configurations, which could enable a network attacker to gain full control of the device. Exploitation requires the victim to use a web browser on a multihomed host with local interfaces on both the Garmin Marine Network and another network, and subsequently visit a malicious third-party website.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-27851

Affected Products

Empirbus Wireless Display Unit Firmware

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-27851 · Security Note
• https://garmin.com · Note
• https://www8.garmin.com/support/ch.jsp?product=010-02642-00 · Note
• https://t.me/cveNotify/165691 · Telegram Post