The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker.
In plain language
Written by AI from the record
If you use an Empirbus wireless display unit (Garmin WDU) with firmware v1 1.4.6 or v2 5.0, a person could take over your device’s settings by tricking an online visitor while that visitor is on your local network; there’s no known patch yet, so you should reduce exposure immediately.
CVE-2025-27851 is a cross-site origin WebSocket hijacking issue (CWE-352) in the locally served web interface of empirbus wireless display unit firmware, enabling an attacker-controlled website to ride on an existing browser-to-device WebSocket session and gain full administrative control of device settings; no device login is required, but user browsing to a malicious site is.
If you're affected
Full device settings takeover
Loss of control of display configuration
Disruption of marine operations
What is it
This vulnerability lets a malicious website “hijack” the communication channel your browser has to the device, kind of like someone swapping the steering wheel while you’re already driving. If a user is on the local Garmin Marine Network and then visits a malicious site, the attacker may be able to change the unit’s settings, including administrative controls.
Who is affected
This matters if you operate an empirbus wireless display unit (Garmin WDU) with firmware v1 1.4.6 or v2 5.0 and you rely on its web-based controls to manage settings. The risk is primarily for anyone using a web browser on a device that’s connected to both the Garmin Marine Network and another network, especially if they visit a malicious third-party website while connected to the local network. This is a risk only when the attacker’s website can be reached by that browser in the moment the user is connected to the vulnerable local network.
How urgent is it
This is an AMBER issue because attackers can potentially gain full control of the device’s settings without needing to break passwords, by leveraging the user’s browser session on the local network. It requires a user to visit a malicious website while connected, so exploitation may not be constant—but it’s still serious for any business using this hardware on a reachable local network.
What to do — in detail
Confirm exposure
Identify the firmware version on your Empirbus wireless display unit (Garmin WDU).
Determine whether you are running v1 1.4.6 or v2 5.0.
Confirm the exposure conditions
Verify whether a staff laptop/tablet/phone is used with a web browser that can reach both:
the Garmin Marine Network, and
some other network (e.g., the internet or a separate network).
Check whether people browse the web while connected to the Garmin Marine Network.
Remediate (interim steps since no patch is known)
Reduce the chance of a malicious website being visited while connected:
Restrict or disable general internet browsing from the device/browser sessions used on the Garmin Marine Network.
Educate users not to click unknown links and to avoid visiting third-party sites while connected.
Reduce network connectivity exposure:
Segment the Garmin Marine Network so it is not broadly routable to the general internet.
If possible, allow only the minimum required traffic from the browser device.
When a fix becomes available
There is currently no fix/patch information available for this CVE.
Once the vendor releases firmware for CVE-2025-27851, upgrade all affected units promptly, and re-test that the device web controls still function normally.
What to monitor
Monitor for unusual administrative or settings changes on the unit (since the attacker goal is configuration takeover).
Track reports of unexpected device behavior that coincides with staff/guest web activity while on the Garmin Marine Network.
Technical context
Severity is high (CVSS 9.3) and the impact is full control of device settings, including administrative functions, in affected versions. The weakness is CWE-352 (cross-site WebSocket hijacking): the vulnerable locally served web interface uses WebSockets, and a malicious website visited by a user can exploit cross-origin WebSocket behavior to hijack the WebSocket session. The attack flow requires no authentication to the device interface (per findings) but requires user interaction (the user must visit a malicious third-party website) and the victim’s browser must be on a multihomed device with local interfaces on the Garmin Marine Network and another network. Exploitation status: no KEV listing and no public exploit code on record; no fix/patch details are available as of the provided findings. EPSS is given as a low, flat prediction, but because there’s no KEV/news confirmation in the findings, it should not be treated as an indicator of active compromise.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
