Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-78617— WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting

Quick assessment

Affected
WatchGuard Dimension
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WatchGuard Dimension 的 Web 登录端点默认未实施有效的速率限制或账户锁定机制，这使得远程攻击者可以对用户账户执行自动化的密码猜测（暴力破解）。如果启用了账户锁定设置，则在达到一定次数的失败尝试后会阻止暴力破解，但该设置在默认情况下是未启用的。

CVSS 6.3 · Medium EPSS 0.32% · P25

Affected Version Matrix 1

VendorProduct Version RangeStatus
WatchGuard Dimension 2.0< 2.3.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-78617

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting
Source: CVE Program / CVE List V5
Vulnerability Description
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined number of failed attempts, but this setting is not enabled by default.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过差异性导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WatchGuard Dimension 2.0 ~ 2.3.1 -

II. Public POCs for CVE-2026-78617

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78617

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-78617 (1)

Same Patch Batch · WatchGuard · 2026-08-27 · 28 CVEs total

CVE-2026-13086 9.3 CRITICAL Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint
CVE-2026-19315 9.3 CRITICAL Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution
CVE-2026-19313 9.3 CRITICAL Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution
CVE-2026-19318 9.3 CRITICAL Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution
CVE-2026-78174 9.3 CRITICAL WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs
CVE-2026-78009 8.7 HIGH Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS)
CVE-2026-13108 8.7 HIGH Dimension Denial-of-Service
CVE-2026-19314 8.7 HIGH Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS)
CVE-2026-19316 8.7 HIGH Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS)
CVE-2026-19317 8.7 HIGH Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)
CVE-2026-78010 8.7 HIGH Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service
CVE-2026-78011 8.7 HIGH Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS)
CVE-2026-78008 8.6 HIGH Fireware OS Authenticated Buffer Overflow in wgagent
CVE-2026-78613 8.6 HIGH Dimension SQL Injection in Log Viewer
CVE-2026-78612 8.6 HIGH Dimension SQL Injection in Scheduled Report
CVE-2026-78614 8.6 HIGH Dimension SQL Injection in Audit Report
CVE-2026-78610 8.4 HIGH Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
CVE-2026-78618 6.9 MEDIUM Dimension Business Logic Flaw Allows Chained Backend Object Operations
CVE-2026-81851 6.9 MEDIUM Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service
CVE-2026-78495 5.3 MEDIUM Dimension Server-Side Request Forgery via Remote Backup Connection Test

Showing top 20 of 28 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Dimension
Same vendor: WatchGuard
Same weakness: CWE-203

V. Comments for CVE-2026-78617

No comments yet

Leave a comment