The Garmin WDU device web interface versions 1.4.6 (v1) and 5.0 (v2) implement authentication only on the client side within the browser, without enforcing authentication on the server side for WebSocket communications. Because the WebSocket APIs lack authentication enforcement, an attacker can bypass the authentication mechanism entirely by directly interacting with these remote APIs over the WebSocket connection, potentially gaining unauthorized access to device functions.

An attacker can bypass the authentication controls of the Garmin WDU web interface by exploiting the unauthenticated WebSocket APIs. This could allow unauthorized access to device functionality exposed through these APIs. The exact impact depends on the capabilities exposed by the WebSocket APIs, but unauthorized control or information disclosure is possible. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restrict network access to the Garmin WDU device web interface to trusted users and networks to reduce exposure.