Garmin WDU Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Garmin WDU web application, specifically in versions 1.1.4.6 and 2.5.0. This vulnerability allows an attacker on the same local network segment to execute arbitrary JavaScript within the context of the WDU webpage. Successful exploitation could lead to full administrative access on the device. To exploit this vulnerability, a victim must first visit a specific URL served by the WDU and then click on a designated element on the page.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, enabling the execution of arbitrary JavaScript in the context of the affected web page.

Remediation

Users can update to Garmin WDU version 7.00, released on April 2, 2026, which addresses this vulnerability.