This vulnerability involves reflected XSS in the Garmin WDU device web interface versions 1.4.6 and 5.0. An attacker on the same local network segment can craft a URL that, when visited and interacted with by the victim, executes arbitrary JavaScript code within the WDU web page context. This can escalate to full administrator privileges on the device. The attack requires two user actions: visiting the malicious URL and clicking an element on the page. The CVSS 3.1 base score is 5.0, indicating medium severity, with attack vector local, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, no impact on availability. There is no known exploit in the wild and no vendor-provided patch or remediation information at this time.

Successful exploitation allows an attacker on the local network to execute arbitrary JavaScript in the context of the Garmin WDU web interface, potentially leading to full administrator access to the device. This compromises device control and confidentiality of information accessible through the device. The attack requires user interaction and local network access, limiting remote exploitation. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the local network segment hosting the Garmin WDU devices and educate users to avoid clicking suspicious URLs served by the device. Monitor vendor communications for updates on patches or official mitigations.