Skip to content
Noroxi

garmin records

19 published records for vendor garmin.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 23
  3. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

19 records
  • CVE-2020-27483
    40Plan

    Garmin Forerunner 235 before 8.20 is affected by: Array index error.

    CriticalCVSS 9.9No exploitEPSS 2%

    garmin · forerunner 235 firmwareNov 16, 2020

  • CVE-2020-27486
    40Plan

    Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow.

    CriticalCVSS 9.9No exploitEPSS 1%

    garmin · forerunner 235 firmwareNov 16, 2020

  • CVE-2020-27484
    40Plan

    Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow.

    CriticalCVSS 9.9No exploitEPSS 1%

    garmin · forerunner 235 firmwareNov 16, 2020

  • CVE-2020-27485
    40Plan

    Garmin Forerunner 235 before 8.20 is affected by: Array index error.

    CriticalCVSS 9.9No exploitEPSS 1%

    garmin · forerunner 235 firmwareNov 16, 2020

  • CVE-2023-23298
    39Monitor

    The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which ca

    CriticalCVSS 9.8No exploitEPSS 1%

    garmin · connect-iqMay 23, 2023

  • CVE-2023-23305
    39Monitor

    The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources.

    CriticalCVSS 9.8No exploitEPSS 1%

    garmin · connect-iqMay 23, 2023

  • CVE-2023-23300
    39Monitor

    The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can re

    CriticalCVSS 9.8No exploitEPSS 1%

    garmin · connect-iqMay 23, 2023

  • CVE-2023-23302
    39Monitor

    The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can res

    CriticalCVSS 9.8No exploitEPSS 1%

    garmin · connect-iqMay 23, 2023

  • CVE-2023-23306
    39Monitor

    The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can r

    CriticalCVSS 9.8No exploitEPSS 1%

    garmin · connect-iqMay 23, 2023

  • CVE-2023-23301
    39Monitor

    The `news` MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end

    CriticalCVSS 9.8No exploitEPSS 1%

    garmin · connect-iqMay 23, 2023

  • CVE-2023-23303
    39Monitor

    The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which ca

    CriticalCVSS 9.8No exploitEPSS 0%

    garmin · connect-iqMay 23, 2023

  • CVE-2009-0194
    38Monitor

    The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug

    CriticalCVSS 9.3No exploitEPSS 2%

    garmin · garmin communicator pluginMay 11, 2009

  • CVE-2025-27851
    37Monitor

    The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack.

    CriticalCVSS 9.3No exploitEPSS 0%

    garmin · empirbus wireless display unit firmwareMay 13, 2026

  • CVE-2023-23304
    36Monitor

    The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toyb

    CriticalCVSS 9.1No exploitEPSS 0%

    garmin · connect-iqMay 23, 2023

  • CVE-2023-23299
    30Monitor

    The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely

    HighCVSS 7.5No exploitEPSS 0%

    garmin · connect-iqMay 23, 2023

  • CVE-2022-46081
    30Monitor

    In Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal infor

    HighCVSS 7.5No exploitEPSS 0%

    garmin · connectJan 4, 2023

  • CVE-2025-27850
    30Monitor

    The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack.

    HighCVSS 7.5No exploitEPSS 0%

    garmin · empirbus wireless display unit firmwareMay 13, 2026

  • CVE-2025-27853
    29Monitor

    The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed.

    HighCVSS 7.3No exploitEPSS 0%

    garmin · empirbus wireless display unit firmwareMay 13, 2026

  • CVE-2025-27852
    20Monitor

    The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack.

    MediumCVSS 5.0No exploitEPSS 0%

    garmin · empirbus wireless display unit firmwareMay 13, 2026