CVE-2025-27853 Auth bypass in n/a
Attackers can bypass authentication on the Garmin WDU by directly accessing unauthenticated WebSocket APIs, allowing unauthorized control of the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27853?
CVE-2025-27853 is a high-severity authentication bypass vulnerability in n/a, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication with the client within the client's browser. The WebSockets used to communicate with the WDU server do not enforce any authentication. An attacker may bypass all authentication mechanisms by directly utilizing the remote APIs available on the websocket.
Weakness: CWE-306
Which versions are affected by CVE-2025-27853?
It affects 1 product.
Products include Garmin Empirbus Wireless Display Unit Firmware.
How do I fix CVE-2025-27853?
No fix has been published for CVE-2025-27853 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-27853 being exploited?
There is no known exploitation of CVE-2025-27853 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cvgr-crrw-gcqx.