CVE-2025-27850

{
  "id": "CVE-2025-27850",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T21:16:41.100",
  "lastModified": "2026-11-04T20:10:00.263",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the filesystem is enabled. This allows an attacker to retrieve arbitrary files from the device."
    },
    {
      "lang": "es",
      "value": "El sitio web servido localmente en el Garmin WDU (v1 1.4.6 y v2 5.0) permite un ataque de enlace simbólico. Si se carga un paquete de gráficos malicioso que contiene enlaces simbólicos, el servidor web sigue los enlaces proporcionados al servir contenido. No hay mecanismos habilitados para restringir esos destinos de enlace a un área específica del sistema de archivos. Esto permite a un atacante recuperar archivos arbitrarios del dispositivo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T15:37:30.402133Z",
          "id": "CVE-2025-27850",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:1.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8EFE7C3-9D69-4C72-B48A-765940650E3D"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:garmin:empirbus_wireless_display_unit:v1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F587398B-B08D-4686-9C08-566BA3AE9489"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:garmin:empirbus_wireless_display_unit_firmware:5.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "26E41D64-3FEB-42AB-A082-5EF5692B3320"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:garmin:empirbus_wireless_display_unit:v2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BA66ECC-D4D6-406A-B5C0-D3251BF47E6C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://garmin.com",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www8.garmin.com/support/ch.jsp?product=010-02642-00",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    }
  ]
}