7.5
CVE-2025-27850
- EPSS 0.39%
- Veröffentlicht 13.05.2026 00:00:00
- Zuletzt bearbeitet 02.06.2026 18:49:39
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the filesystem is enabled. This allows an attacker to retrieve arbitrary files from the device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Garmin ≫ Empirbus Wireless Display Unit Firmware Version1.4.6
Garmin ≫ Empirbus Wireless Display Unit Firmware Version5.00
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.39% | 0.304 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-59 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
https://garmin.com
https://www8.garmin.com/support/ch.jsp?product=010-02642-00