Garmin International — 14 prefixes (MA-L)

Garmin International, Inc. is the US operating subsidiary of Garmin Ltd. (NYSE: GRMN, incorporated in Schaffhausen, Switzerland since 2010; formerly Nasdaq-listed until its December 2021 transfer to the NYSE), headquartered at 1200 E. 151st St, Olathe, KS 66062. It holds 14 IEEE MA-L (24-bit) OUI assignments and zero entries in the MA-M or MA-S registries — a substantial, well-corroborated footprint rather than a bare single-block registration. Thirteen of the fourteen rows share the exact "1200 E. 151st St Olathe KS US 66062" registry address; the fourteenth (10:C6:FC) is registered to the same street address with only cosmetic formatting differences ("1200 East 151st Street Olathe KS US 66062"), so all 14 blocks trace to Garmin's single Olathe campus with no distinct outlier location. Garmin is a household-name GPS/wearables company founded in 1989 (originally "ProNav" in Lenexa, KS; HQ moved to Olathe in 1996), with over 200 million products sold across automotive, aviation, marine, fitness/wearable, and outdoor-handheld product lines, and more than 4,000 employees at the Olathe campus alone. Security context is genuine and multi-faceted rather than theoretical: Garmin was the victim of a high-profile WastedLocker ransomware attack in July 2020 (attributed to the Evil Corp threat actor) that took down Garmin Connect, flyGarmin, and call-center operations for several days and was reported to have ended in a multimillion-dollar ransom payment; separately, its own device firmware has documented CVEs — CVE-2023-23299 and related Connect IQ (CIQ) API permission-model bypass flaws affecting over 100 wearable models (fixed by Garmin in CIQ 3.1.x+), and CVE-2025-27850, a symlink-attack flaw in the locally-served web UI on the Garmin WDU wireless data unit. A Garmin OUI on a network therefore plausibly identifies genuine consumer/prosumer navigation or wearable hardware, and the vendor has a real, disclosed vulnerability history worth flagging to a network defender.

IEEE assignment

14 prefixes → Garmin International (MA-L only; 0 matches in MA-M/MA-S) [Confirmed] — the IEEE MA-L registry, the IEEE MA-M registry, the IEEE MA-S registry

HQ / registered address

1200 E. 151st St, Olathe, KS 66062, US — 13 of 14 rows verbatim; 1 row (10:C6:FC) same street address with cosmetic spacing/wording differences only, no distinct location [Confirmed] — the IEEE MA-L registry

Company status / substance

active, publicly traded — Garmin Ltd., NYSE: GRMN (Nasdaq-listed until transferring to NYSE, trading began Dec 7, 2021), incorporated in Schaffhausen, Switzerland since 2010; US operating unit is Garmin International, Inc.; founded 1989, HQ moved to Olathe, KS in 1996; 200M+ products sold, 4,000+ employees at the Olathe campus [Confirmed] — https://www.garmin.com/en-US/newsroom/press-release/corporate/garmin-announces-transfer-of-listing-to-the-new-york-stock-exchange/, https://en.wikipedia.org/wiki/Garmin, https://www.garmin.com/en-US/newsroom/press-release/corporate/2018-garmin-growth-continues-to-accelerate-as-the-company-celebrates-200-million-products-sold-and-opens-its-olathe-campus-expansion/

Device types

GPS navigation and wearable technology across automotive, aviation, marine, fitness/sport, and outdoor-handheld product lines (e.g. fitness/running watches with Connect IQ, aviation avionics, marine chartplotters, automotive nav units)

[Confirmed] — https://www.garmin.com/en-US/, https://en.wikipedia.org/wiki/Garmin

Security note (own infrastructure)

July 2020 WastedLocker ransomware attack (attributed to Evil Corp) took Garmin Connect, flyGarmin, and customer support/call-center operations offline for multiple days; multiple outlets reported a multimillion-dollar ransom payment

[Confirmed] — https://heimdalsecurity.com/blog/about-the-garmin-ransomware-case/, https://nordvpn.com/blog/garmin-ransomware/

Security note (device firmware)

CVE-2023-23299 and related Connect IQ (CIQ) TVM permission-bypass vulnerabilities affected 100+ Garmin wearable models (fitness watches, outdoor handhelds, bike GPS) across CIQ API 1.0.0–4.1.7, allowing sandbox escape / arbitrary code execution and disclosure of profile and GPS data; fixed by Garmin in CIQ 3.1.x+ and later [Confirmed] — https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23302.md, https://www.anvilsecure.com/blog/compromising-garmins-sport-watches-a-deep-dive-into-garminos-and-its-monkeyc-virtual-machine.html, https://the5krunner.com/2023/05/08/garmin-ciq-hacker-exposes-13-vulnerabilities-affecting-100-garmin-models/

Security note (device firmware, other)

CVE-2025-27850 — locally served web UI on the Garmin WDU (wireless data unit, v1 1.4.6 and v2 5.0) allows a symlink attack enabling retrieval of arbitrary files from the device [Confirmed] — https://github.com/advisories/GHSA-rp9w-778v-4h8m

No-date caveat

IEEE's public the IEEE MA-L registry contains no assignment/registration date column for any of these 14 rows. A third-party lookup site (maclookup.app) displays a spread of dates ("2001-10-24" through "2025-11-25") across Garmin's prefixes and frames them as "registered"/"updated" dates — these are database artifacts of that third-party's tracking process, not IEEE facts, and are not recorded here as registration dates [Confirmed] — the IEEE MA-L registry (schema check); https://maclookup.app/vendors/garmin-international (third-party artifact, not cited as fact)

Verified sample prefixes (all MA-L, Garmin International)

B4:C2:6A, 10:4E:89, E0:48:24, 00:05:4F [Confirmed] — the IEEE MA-L registry