EUVD-2026-67345
GHSA-8xpm-cmp9-mq75
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires an existing low-privileged admin account so PR:L and AC:L; token theft crosses into the Super Admin authority (S:C) yielding high confidentiality and integrity, with no availability impact.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.
AnalysisAI
Privilege escalation to account takeover in WatchGuard Dimension allows a low-privileged Dimension Administrator to hijack a Super Administrator account by harvesting that user's session token from a diagnostic log in the web UI. Because session identifiers are written unredacted, any authenticated administrator who can read the diagnostic log can impersonate a Super Administrator while that user is logged in, gaining full control of the management platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privileged Dimension Administrator account with the ability to retrieve the web UI diagnostic log (PR:L), and it succeeds only while a Super Administrator is concurrently logged in, because the harvested artifact is that admin's live session token. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per WatchGuard PSIRT advisory (https://psirt.watchguard.com/CVE-2026-78174); apply the fixed Dimension build listed there as soon as it is validated - an exact fixed version was not included in the provided data and should be taken from the advisory rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Restrict diagnostic log access in Dimension to Super Administrators only; audit current admin account assignments and disable any unnecessary administrative accounts; enable detailed audit logging for all diagnostic log access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
WatchGuard Dimension's log listening service can be rendered unavailable by an unauthenticated remote attacker flooding
Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as
Authenticated SQL injection in WatchGuard Dimension's audit report feature enables privilege escalation to arbitrary OS
WatchGuard Dimension's log viewer feature exposes an SQL injection flaw that escalates directly to arbitrary command exe
WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account take
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
Dimension versions 4.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
Dimension versions 4.0.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code
Dimension versions 3.4.11 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrar
Dimension versions 3.4.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrar
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today