Kritik CVSS 9.3
CVE-2025-27851: Empirbus Wireless Display Unit Firmware: siteler arası istek sahteciliği (CSRF)
Açıklama (NVD)
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker.
Özet bilgiler
- Ürün
- Garmin Empirbus Wireless Display Unit Firmware
- CVSS v3.1
- 9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - EPSS
- %0,15 (yüzdelik 4)
- CWE
- CWE-352
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| garmin-empirbus-wireless-display-unit-firmware | 1.4.6 | 1.4.6 | — |
| garmin-empirbus-wireless-display-unit-firmware | 5.00 | 5.00 | — |