The device’s locally served web interface hosts a reflected cross‑site scripting flaw. When an attacker on the same local network loads a specially crafted URL and a user clicks an element, the browser runs attacker‑supplied JavaScript in the context of the WDU webpage. Because the page runs with full administrator privileges on the device, the injected script can obtain complete control of the unit, including the ability to read and modify configuration, exfiltrate data, or disrupt functionality. The weakness is a classic reflected XSS (CWE‑79).

The vulnerability affects Garmin Wireless Data Unit firmware versions 1.4.6 and 5.0. No other vendors or products are listed.

The CVSS score of 5 indicates moderate risk, and the EPSS score of <1% suggests a low likelihood of exploitation in the near term. The issue is not listed in CISA’s KEV catalog, yet the risk to any customer using the listed firmware is high because the flaw gives full administrative access. Exploitation requires that the victim view a specific URL and then click an element, so it needs user interaction; however, an authenticated user or anyone with local network access could trigger the attack. No publicly documented exploits exist yet, yet the risk to any customer using the listed firmware is high because the flaw gives full administrative access.