WatchGuard Dimension CVE-2026-78174

Exploitation requires an authenticated low-privileged Dimension Administrator account with the ability to retrieve the web UI diagnostic log (PR:L), and it succeeds only while a Super Administrator is concurrently logged in, because the harvested artifact is that admin's live session token. There is no user-interaction requirement (UI:N) and the attack is network-reachable against the management interface (AV:N). The principal limiting factors are the need for pre-existing administrative credentials and the timing dependency on an active Super Administrator session; the exposure is inherent to the default logging behavior rather than requiring a non-default configuration.

This is a genuine high-priority issue, not an inflated CVSS number. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation needing only existing low-privileged admin credentials and no user interaction, with high confidentiality and integrity impact on both the vulnerable and a subsequent system (VC:H/VI:H/SC:H) - consistent with token theft leading to full account takeover. The key limiter is PR:L: an attacker must already hold a Dimension Administrator account, so this is an insider or post-compromise privilege-escalation primitive rather than a pre-auth internet worm, which likely keeps mass-exploitation probability modest. EPSS and SSVC values were not provided in the input and cannot be asserted; KEV status is not listed and there is no POC indication, so exploitation appears theoretical for now. Even so, the additional timing requirement (the Super Administrator must be logged in) is weak protection in practice because busy platforms have admins logged in routinely, so any organization running Dimension with more than one admin tier should treat this as urgent and patch promptly.

A help-desk staffer holding only a Dimension Administrator account opens the web UI diagnostic log, locates the unredacted session identifier belonging to a currently logged-in Super Administrator, and replays that token in their own browser to assume the Super Administrator session. With AV:N/AC:L and no user interaction required, the attacker then reconfigures the platform or exfiltrates aggregated Firebox log data as a full administrator. No public exploit code is known, so this would rely on manual token replay.