Is CVE-2025-27853 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-27853 being exploited in the wild.

How severe is CVE-2025-27853?

High severity, with a CVSS score of 7.3, published 13 May 2026.

Is there a fix for CVE-2025-27853?

A patch was published on 2026-04-02: Fixed in WDUv2 software version 5.41 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-27853 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-27853?

Check whether you run Garmin EmpirBus WDU v1, Garmin EmpirBus WDU v2, Garmin EmpirBus Wireless Display Unit (WDU) v1 firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-27853: Garmin EmpirBus WDU authentication bypass in WebSocket API

CVE-2025-27853 · Severity: high · CVSS 7.3 · Published 2026-05-13

The Garmin EmpirBus Wireless Display Unit (WDU), a device used for marine digital switching and monitoring, contains a security flaw in its local web interface. An attacker can bypass the login screen to gain unauthorized access to the device's control functions and data. This could allow an unauthorized user on the network to interfere with vessel monitoring systems or change device settings.

Technologies: Garmin EmpirBus WDU v1, Garmin EmpirBus WDU v2. Vendors: Garmin.

Quick answers

Is CVE-2025-27853 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-27853 being exploited in the wild.
How severe is CVE-2025-27853?: High severity, with a CVSS score of 7.3, published 13 May 2026.
Which products and versions are affected?: Garmin EmpirBus WDU v1 1.4.6; Garmin EmpirBus WDU v2 5.0; Garmin EmpirBus Wireless Display Unit (WDU) v1 firmware 1.4.6; Garmin EmpirBus Wireless Display Unit (WDU) v2 firmware 5.00.
Is there a fix for CVE-2025-27853?: A patch was published on 2026-04-02: Fixed in WDUv2 software version 5.41 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-27853 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-27853?: Check whether you run Garmin EmpirBus WDU v1, Garmin EmpirBus WDU v2, Garmin EmpirBus Wireless Display Unit (WDU) v1 firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in the Garmin EmpirBus Wireless Display Unit (WDU) v1 (firmware 1.4.6) and v2 (firmware 5.0). While the web interface implements a client-side authentication check in the browser, the backend WebSocket server does not enforce any authentication for incoming requests. A remote attacker can bypass all authentication mechanisms by directly interacting with the remote APIs available via the WebSocket. This allows for unauthorized read and write access to device functions. The issue is addressed in WDUv2 software version 5.41 and later.

Affected products

Garmin EmpirBus Wireless Display Unit (WDU) v1 firmware 1.4.6
Garmin EmpirBus Wireless Display Unit (WDU) v2 firmware 5.00

Timeline

2025-05-13: disclosed
2026-04-02: patched: Fixed in WDUv2 software version 5.41
2026-05-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.