CVE-2025-27853
Last modified
CVE-2025-27853 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication with the client within the client's browser. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication with the client within the client's browser. The WebSockets used to communicate with the WDU server do not enforce any authentication. An attacker may bypass all authentication mechanisms by directly utilizing the remote APIs available on the websocket.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Garmin | Empirbus Wireless Display Unit Firmware | 1.4.6 |
| Garmin | Empirbus Wireless Display Unit Firmware | 5.00 |
References
- https://garmin.comProduct
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-27853?
How severe is CVE-2025-27853?
How do I fix CVE-2025-27853?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-27845In ESPEC North America Web Controller 3 before 3.3.4, /api/v…9.8
- CVE-2025-27846In ESPEC North America Web Controller 3 before 3.3.8, an att…4.3
- CVE-2025-27847In ESPEC North America Web Controller 3 before 3.3.8, /api/v…4.3
- CVE-2025-27850The locally served web site on the Garmin WDU (v1 1.4.6 and …7.5
- CVE-2025-27851The locally served web site on the Garmin WDU (v1 1.4.6 and …9.3
- CVE-2025-27852The locally served web site on the Garmin WDU (v1 1.4.6 and …5
- CVE-2025-2786A flaw was found in Tempo Operator, where it creates a Servi…4.3
- CVE-2025-27867Improper Neutralization of Input During Web Page Generation …5.6
- CVE-2025-2787KNIME Business Hub is affected by the Ingress-nginx CVE-2025…8.8
- CVE-2025-27888Severity: medium (5.8) / important Server-Side Request Forg…5.4
- CVE-2025-27889Wing FTP Server before 7.4.4 does not properly validate and …8.8
- CVE-2025-2789The MultiVendorX – Empower Your WooCommerce Store with a Dyn…6.5
Are you affected by CVE-2025-27853?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST