{"cve":"CVE-2025-27853","nvd":{"published":"2026-05-13T21:16:41.463","modified":"2026-06-17T09:04:20.340","status":"Analyzed","description":"The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication with the client within the client's browser. The WebSockets used to communicate with the WDU server do not enforce any authentication. An attacker may bypass all authentication mechanisms by directly utilizing the remote APIs available on the websocket.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":7.3},"cwes":["CWE-306"],"references":["https://garmin.com","https://www8.garmin.com/support/ch.jsp?product=010-02642-00"],"products":["garmin:empirbus_wireless_display_unit_firmware"],"source":"nvd","synced_at":"2026-10-19T22:35:16.954578616+00:00"},"epss":{"cve":"CVE-2025-27853","score":0.00297,"percentile":0.22359,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}