CVE-2025-27851 Cross-site request forgery in n/a
A network attacker can hijack WebSockets to take full control of a Garmin WDU if the victim visits a malicious site from a multihomed host.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-27851?
CVE-2025-27851 is a critical vulnerability in n/a, published on 13 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker.
Weakness: CWE-352
Which versions are affected by CVE-2025-27851?
It affects 1 product.
Products include Garmin Empirbus Wireless Display Unit Firmware.
How do I fix CVE-2025-27851?
No fix has been published for CVE-2025-27851 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-27851 being exploited?
There is no known exploitation of CVE-2025-27851 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-frpq-7mr9-hx8p.