WatchGuard Dimension CVE-2026-13108

No special configuration, authentication, or elevated privilege is required - the attack targets the log listening service in its default operational state. The sole prerequisite is network reachability to the Dimension log listener TCP port; if that port is restricted by firewall ACL or network segmentation to trusted appliance source addresses only, the attack surface is eliminated. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated remote exploitation with no special attack preconditions and no user interaction needed. Exploitation is limited by whatever network access controls are in place between the attacker and the listener port.

The CVSS 4.0 base score of 8.7 reflects a network-accessible (AV:N), low-complexity (AC:L), no-privilege (PR:N), no-user-interaction (UI:N) attack path with high availability impact (VA:H) and no confidentiality or integrity impact - metrics that accurately characterize a SYN flood attack. No EPSS score was included in the provided intelligence, leaving probabilistic exploitation likelihood unquantified. The CVE does not appear in the CISA KEV catalog, so active exploitation has not been confirmed by threat intelligence sources, and no public proof-of-concept exploit code was identified. Real-world risk is primarily operational: loss of the Dimension log listening service disrupts log ingestion and security visibility across WatchGuard-managed infrastructure, potentially impairing incident detection during an active attack campaign. The severity is highest for organizations with the log listener port directly internet-exposed; deployments that restrict the port to trusted appliance source IPs via ACL or network segmentation face substantially reduced actual exposure despite the high base score.

An unauthenticated attacker with network access to the Dimension log listener port sends a sustained high-volume TCP SYN flood using widely available tooling (e.g., hping3 or similar), exhausting the service's connection-handling capacity and making it unresponsive to legitimate appliance log submissions. No special exploit code is required beyond standard SYN flood capability. The resulting loss of log ingestion blinds security operations to events occurring across WatchGuard-managed infrastructure for the duration of the attack.