CVE-2025-27851: Garmin EmpirBus WDU Cross-Site WebSocket Hijacking

CVE-2025-27851 · Severity: critical · CVSS 9.3 · Published 2026-05-13

The Garmin EmpirBus Wireless Display Unit (WDU), a device used for marine system monitoring and control, contains a vulnerability that allows an attacker to take full control of the device. By tricking a user into visiting a malicious website while they are connected to the boat's marine network, an attacker can hijack the device's communication channel. This could allow unauthorized changes to administrative settings and critical marine system controls.

Technologies: Garmin EmpirBus WDU v1, Garmin EmpirBus WDU v2. Vendors: Garmin.

Quick answers

Is CVE-2025-27851 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-27851 being exploited in the wild.
How severe is CVE-2025-27851?
Critical severity, with a CVSS score of 9.3, published 13 May 2026.
Which products and versions are affected?
Garmin EmpirBus WDU v1 1.4.6; Garmin EmpirBus WDU v2 5.0; Garmin EmpirBus Wireless Display Unit (WDU) v1 1.4.6; Garmin EmpirBus Wireless Display Unit (WDU) v2 5.00.
Is there a fix for CVE-2025-27851?
A patch was published on 2026-04-02: WDUv2 software version 7.00 released; version 5.41 previously fixed the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-27851 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-27851?
Check whether you run Garmin EmpirBus WDU v1, Garmin EmpirBus WDU v2, Garmin EmpirBus Wireless Display Unit (WDU) v1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the locally served web interface of the Garmin EmpirBus WDU (v1 version 1.4.6 and v2 version 5.00). The application fails to properly validate the 'Origin' header during the WebSocket handshake, allowing a malicious third-party website to establish a cross-origin connection to the device's WebSocket server. If a user on a multihomed host (connected to both the Garmin Marine Network and the internet) visits an attacker-controlled site, the attacker can send commands via WebSockets to modify administrative settings. This results in full device compromise. The issue is addressed in WDUv2 software version 5.41 and later.

Affected products

  • Garmin EmpirBus Wireless Display Unit (WDU) v1 1.4.6
  • Garmin EmpirBus Wireless Display Unit (WDU) v2 5.00

Timeline

  • 2026-04-02: patched: WDUv2 software version 7.00 released; version 5.41 previously fixed the issue.
  • 2026-05-13: disclosed: Initial CVE publication.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.