CVE-2026-78617 — WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessin…
Published: 2026-08-27 · CVSS: 6.3 · CVSS 4.0
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined number of failed attempts, but this setting is not enabled by default.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7