WatchGuard Dimension EUVD-2026-67350

Exploitation requires network access to the WatchGuard Dimension management interface and a valid authenticated session with at least low-privilege (PR:L per CVSS 4.0) - the vendor description further specifies a 'privileged' attacker role, suggesting a specific elevated Dimension role may be required rather than any authenticated user (this discrepancy should be verified with WatchGuard). The specific vulnerable feature is the Remote Backup Connection Test within the configuration panel; access to this specific configuration section is prerequisite. Exploitation is limited by: (1) mandatory authenticated access, ruling out unauthenticated remote exploitation; (2) impact confined to service enumeration on adjacent systems rather than code execution, data exfiltration from the Dimension host, or integrity modification; (3) the Dimension management interface is typically not internet-facing in well-managed environments, further restricting attacker reach. No non-default product configuration beyond standard deployment is stated as required.

The CVSS 4.0 score of 5.3 reasonably reflects the actual risk profile. The network attack vector (AV:N) and low complexity (AC:L/AT:N) widen the exposure surface, but PR:L constrains exploitation to authenticated sessions - opportunistic unauthenticated exploitation is not possible. The impact is bounded: no confidentiality, integrity, or availability harm to the Dimension system itself (VC:N/VI:N/VA:N), with only limited subsequent-system confidentiality exposure (SC:L) in the form of service enumeration. There is a notable discrepancy between the description's use of 'authenticated privileged attacker' and the CVSS 4.0 vector's PR:L - if exploitation truly requires elevated/privileged Dimension roles, real-world risk is further reduced beyond what PR:L suggests; defenders should verify the exact privilege tier required with WatchGuard. No KEV listing and no identified POC indicate this has not been mass-exploited. The primary realistic threat model is a malicious insider or an attacker who has already obtained Dimension credentials using this flaw for internal network reconnaissance rather than as an initial access vector.

An attacker with a valid low-privilege (or higher) WatchGuard Dimension account navigates to the Remote Backup Connection Test configuration interface and submits crafted requests specifying internal IP addresses and port numbers as the backup target. By observing connection success, timeout, or error responses, the attacker systematically enumerates which adjacent hosts are alive and which services are reachable from the Dimension server, constructing an internal network map to support subsequent lateral movement. No public proof-of-concept code has been identified, but the technique is well-understood for SSRF vulnerabilities of this class.