WatchGuard Dimension CVE-2026-78617

The primary enabling condition is WatchGuard Dimension's default configuration: account lockout is disabled out of the box, so any deployment that has not explicitly enabled this setting accepts unlimited authentication attempts. Exploitation further requires that the Dimension web login endpoint is network-reachable by the attacker - risk is highest when the management interface is exposed to untrusted networks or the internet without VPN or firewall restrictions. The CVSS AC:H rating reflects that a successful attack depends on target accounts having weak or guessable passwords; accounts protected by strong, unique credentials resist brute-force even without lockout. If an administrator has enabled the account lockout feature, brute-force attempts are blocked after the configured threshold, directly negating this vulnerability. No special product feature activation is required on the attacker side - the vulnerable behavior exists in the standard, default web login flow accessible to any unauthenticated network client.

The CVSS 4.0 base score of 6.3 with vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N reflects a network-exposed, unauthenticated attack path with moderate complexity. AC:H appropriately captures that successful exploitation depends on significant automated effort and the presence of weak or guessable account passwords. Integrity impact is rated Low (VI:L), corresponding to unauthorized account access rather than host-level compromise. No KEV listing and no public exploit code have been identified, limiting immediate threat actor pressure. However, the default-off lockout configuration means the vulnerability is present across all Dimension deployments unless an administrator has explicitly hardened the product - reducing the effective exploitation barrier in practice. The CWE-203 enumeration component, if confirmed, would meaningfully reduce brute-force effort by allowing attackers to validate account names before password guessing. EPSS data is absent from available intelligence, so exploitation probability cannot be numerically quantified. Overall, real-world risk is moderate and elevated for organizations that expose the Dimension management interface to untrusted networks or enforce weak password policies.

A remote attacker locates a publicly accessible WatchGuard Dimension web portal - common where management interfaces are exposed to the internet without VPN enforcement. The attacker first probes the login endpoint for observable response differences (per CWE-203) to enumerate valid usernames, then submits automated credential-stuffing or dictionary attacks against those accounts. Because no rate-limiting or lockout is enforced in default configurations, the attacker can iterate through thousands of passwords unchecked until matching credentials yield authenticated access to the Dimension management console.