The Garmin WDU firmware versions 1.4.6 and 2 5.0 expose a local web interface that performs authentication only when access occurs within the client’s browser. The WebSocket endpoints used for device communication do not enforce any authentication, allowing an attacker to invoke the remote APIs directly. This flaw permits an authenticated state to be forged, granting unauthorized control over device functions that the API exposes, and represents an insufficient authentication weakness (CWE‑306).

Vendors: Garmin. Products: Garmin WDU firmware 1.4.6 and 2 5.0. No other product or version information is listed in the current advisories.

The EPSS score of < 1 % indicates an extremely low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.3 classifies the flaw as high severity, with the potential for full device control if exploited. Based on the description, it is inferred that an attacker must have network access to the device’s locally served web service, typically from the same local network, to establish the WebSocket connection. No public exploits or detailed attack paths have been reported, but the lack of authentication on the API endpoints creates a clear risk of unauthorized operations.