The Garmin WDU web interface serves a locally hosted site that uses WebSockets to control both normal and administrative settings. A flaw in the origin validation allows a cross‑site origin WebSocket hijacking attack. If an attacker can get a user to visit a malicious site while the user’s browser is on the Garmin Marine Network, the attacker can hijack the WebSocket connection and issue commands that give full control over the WDU.

Garmin WDU version 1 (1.4.6) and version 2 (5.0) are affected. No other vendors or products are known from the CNA data. Systems running these firmware versions that expose the web interface are at risk.

EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, so there is no public data on active exploitation. The attack path requires the victim to be using a browser on a multihomed host that has interfaces on both the Garmin network and another network, and to navigate to a malicious website that initiates the WebSocket hijack. Attackers would therefore need user interaction, making the likelihood moderate. Nonetheless, the impact is high: a successful exploit provides administrative control over the device, potentially allowing unauthorized configuration changes or data exfiltration. The CVSS score is 9.3, indicating high severity.