CVE-2026-78617: WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined number of failed attempts, but this setting is not enabled by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable the account lockout setting for WatchGuard Dimension web login so brute-force attempts are blocked after a defined number of failed attempts (the setting is not enabled by default).
WatchGuard Dimension Web UI authentication account lockout (enabled) = enabled - Compensating control
Add/enforce effective rate-limiting on the WatchGuard Dimension web login endpoint so automated password guessing is throttled, since the endpoint does not enforce effective rate-limiting by default.
Event History
Frequently Asked Questions
Which deployments are exposed by default?
WatchGuard Dimension Web UI deployments are exposed when the account lockout setting remains at its default disabled state. In that configuration, the login endpoint does not effectively rate-limit automated password guesses.
What does an attacker need to exploit this issue?
An attacker needs remote access to the web login endpoint and can automate password guessing against user accounts. The provided information does not identify any additional prerequisite.
What mitigation is available if patching is not immediately possible?
Enable the account lockout setting. When enabled, it blocks brute-force attempts after a defined number of failed login attempts.
How can administrators determine whether they are affected?
Check whether account lockout is enabled in the WatchGuard Dimension Web UI configuration. Systems with account lockout disabled are in the default affected configuration.