Dashboard / CVE-2025-27853

CVE-2025-27853

HIGH
MEDIUM Priority: 0.02 BB Relevance: 75/100
Published: 2026-05-13 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: Low
A: Low

Description

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication with the client within the client's browser. The WebSockets used to communicate with the WDU server do not enforce any authentication. An attacker may bypass all authentication mechanisms by directly utilizing the remote APIs available on the websocket.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
garmin empirbus_wireless_display_unit_firmware 1.4.6
garmin empirbus_wireless_display_unit_firmware 5.00

References & Advisories (2)

Bug Bounty Relevance

75 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS — Exploitation Probability

0.30%
Raw Score 0.002970
Percentile 22.5%
Date 2026-11-04

Intelligence Sources

nvd ref →

External Links