by Kastro
Paper/Archive/CVE-2025-27851

CVE-2025-27851

mitre — The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack.

EPSS 0.1%CVSS 9.3
critical.is priorityof 100
29
CVSS 9.3 (ADP)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 3.8.038 × 200.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgarmin.comrefwww8.garmin.com/support/ch.jsp?product=010-02642-00