CVE-2026-78617 — WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting

CVE-2026-78617

WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting PUBLISHED

Description (CNA)

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined number of failed attempts, but this setting is not enabled by default.

Affected (CNA)

Vendor / product	Versions
WatchGuard / Dimension	affected 2.0 before 2.3.1

CWE

CWE-203, CWE-307

References

https://psirt.watchguard.com/CVE-2026-78617

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.