CVE-2026-78610— Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
Quick assessment
Affected
WatchGuard Dimension
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WatchGuard Dimension是美国WatchGuard公司的一款网络安全监控与报告管理平台。 WatchGuard Dimension 2.0至2.3.1之前版本存在跨站请求伪造漏洞，该漏洞源于Web UI中的管理员口令更改操作缺乏跨站请求伪造保护，可能导致攻击者诱导已认证的全局管理员浏览器访问特制链接或页面，在管理员不知情的情况下将其口令更改为攻击者选择的值。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WatchGuard | Dimension | 2.0< 2.3.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78610
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
WatchGuard Dimension 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WatchGuard Dimension是美国WatchGuard公司的一款网络安全监控与报告管理平台。 WatchGuard Dimension 2.0至2.3.1之前版本存在跨站请求伪造漏洞，该漏洞源于Web UI中的管理员口令更改操作缺乏跨站请求伪造保护，可能导致攻击者诱导已认证的全局管理员浏览器访问特制链接或页面，在管理员不知情的情况下将其口令更改为攻击者选择的值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WatchGuard | Dimension | 2.0 ~ 2.3.1 | - |
|
II. Public POCs for CVE-2026-78610
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78610
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78610 (1)
Same Patch Batch · WatchGuard · 2026-08-27 · 28 CVEs total
| CVE-2026-13086 | 9.3 CRITICAL | Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint |
| CVE-2026-19315 | 9.3 CRITICAL | Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution |
| CVE-2026-19313 | 9.3 CRITICAL | Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution |
| CVE-2026-19318 | 9.3 CRITICAL | Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution |
| CVE-2026-78174 | 9.3 CRITICAL | WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs |
| CVE-2026-78009 | 8.7 HIGH | Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS) |
| CVE-2026-13108 | 8.7 HIGH | Dimension Denial-of-Service |
| CVE-2026-19314 | 8.7 HIGH | Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS) |
| CVE-2026-19316 | 8.7 HIGH | Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS) |
| CVE-2026-19317 | 8.7 HIGH | Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS) |
| CVE-2026-78010 | 8.7 HIGH | Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service |
| CVE-2026-78011 | 8.7 HIGH | Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS) |
| CVE-2026-78008 | 8.6 HIGH | Fireware OS Authenticated Buffer Overflow in wgagent |
| CVE-2026-78613 | 8.6 HIGH | Dimension SQL Injection in Log Viewer |
| CVE-2026-78612 | 8.6 HIGH | Dimension SQL Injection in Scheduled Report |
| CVE-2026-78614 | 8.6 HIGH | Dimension SQL Injection in Audit Report |
| CVE-2026-78618 | 6.9 MEDIUM | Dimension Business Logic Flaw Allows Chained Backend Object Operations |
| CVE-2026-81851 | 6.9 MEDIUM | Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service |
| CVE-2026-78617 | 6.3 MEDIUM | WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting |
| CVE-2026-78495 | 5.3 MEDIUM | Dimension Server-Side Request Forgery via Remote Backup Connection Test |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Dimension
-
CVE-2026-86135
Dimension CSRF Vulnerability in Database Snapshot Creation A -
CVE-2026-78616
Dimension Stored XSS via Trusted CA Certificate Configuratio -
CVE-2026-78612
Dimension SQL Injection in Scheduled Report -
CVE-2026-78498
Dimension Server-Side Request Forgery via Email Server Test -
CVE-2026-78047
Dimension Stored XSS in Scheduled Report Task
Same vendor: WatchGuard
-
CVE-2026-13043
WatchGuard Endpoint Security Missing Authentication in Kerne -
CVE-2026-86134
Fireware OS Pre-Authentication NULL Pointer Dereference Allo -
CVE-2026-90441
Fireware OS Missing Authorization in wgagent Management API -
CVE-2026-13224
Fireware OS Path Traversal in WebUI Management Agent Allows -
CVE-2026-18145
Fireware OS Stack-based Buffer Overflow in spamd Allows Remo
Same weakness: CWE-352
-
CVE-2026-89279
Active Directory Password Change CSRF in AuthTake Technology -
CVE-2026-103076
WordPress User Registration plugin <= 5.2.8 - Cross Site Req -
CVE-2026-54459
FileRise: Missing CSRF enforcement for file creation and sha -
CVE-2022-51020
Flower before 2.2.0 CSRF via Worker and Task Control API End -
CVE-2026-59977
ConvertX: Cross-Site Request Forgery (CSRF) leading to Unaut
V. Comments for CVE-2026-78610
No comments yet