7.3
CVE-2025-27853
- EPSS 0.3%
- Veröffentlicht 13.05.2026 00:00:00
- Zuletzt bearbeitet 02.06.2026 18:55:42
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication with the client within the client's browser. The WebSockets used to communicate with the WDU server do not enforce any authentication. An attacker may bypass all authentication mechanisms by directly utilizing the remote APIs available on the websocket.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Garmin ≫ Empirbus Wireless Display Unit Firmware Version1.4.6
Garmin ≫ Empirbus Wireless Display Unit Firmware Version5.00
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.3% | 0.211 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 7.3 | 3.9 | 3.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
|
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
https://garmin.com
https://www8.garmin.com/support/ch.jsp?product=010-02642-00