EUVD-2025-209830
GHSA-qcwv-872h-7hpj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an attacker on the local network segment to execute arbitrary JavaScript code within the context of the WDU webpage. Full administrator level access to the device is possible. To initiate an exploit of this vulnerability, the victim must execute two actions: (1) view a specific URL served by the WDU, and (2) click an element on the rendered page.
AnalysisAI
Reflected cross-site scripting (XSS) in Garmin WDU v1 1.4.6 and v2 5.0 allows local network attackers to execute arbitrary JavaScript with full administrator-level access to the device. Exploitation requires the victim to visit a malicious URL and click an element on the rendered page, making this a moderate-risk vulnerability primarily affecting users on trusted networks who may be socially engineered.
Technical ContextAI
The Garmin WDU (Wearable Device Updater) is a locally served web application that fails to properly sanitize user-supplied input in URL parameters before reflecting it back in HTML responses. This is a classic reflected XSS vulnerability (CWE-79) where an attacker can craft a malicious URL containing JavaScript payload that executes in the victim's browser within the security context of the WDU web application. Because the WDU runs locally with administrative privileges and manages wearable device updates, successful XSS exploitation grants the attacker the same privileges as the authenticated administrator viewing the page.
RemediationAI
Upgrade Garmin WDU to a patched version released after v1 1.4.6 and v2 5.0 - consult Garmin support page https://www8.garmin.com/support/ch.jsp?product=010-02642-00 for the exact fixed version. If a patch is unavailable, implement network-level compensating controls: restrict WDU web interface access to trusted administrative users only via firewall rules (block TCP ports used by WDU from untrusted network segments), disable remote access to the WDU web server if not required, and educate users to avoid clicking links from untrusted sources that reference local WDU URLs. Note that these controls do not eliminate the vulnerability but reduce the attack surface to intentional social engineering rather than opportunistic exploitation.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today