VYPR
← All advisories
High severity7.5NVD Advisory· Published May 13, 2026· Updated Jun 2, 2026

CVE-2025-27850

CVE-2025-27850

Description

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the filesystem is enabled. This allows an attacker to retrieve arbitrary files from the device.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Garmin/Empirbus Wireless Display Unit Firmware2 versions
    cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:1.4.6:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:1.4.6:*:*:*:*:*:*:*
    • cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:5.00:*:*:*:*:*:*:*
  • Garmin/WDUllm-fuzzy
    Range: v1 1.4.6, v2 5.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.