CVE-2026-78610: CWE-352 in WatchGuard Dimension

WatchGuard Dimension version 2.0 contains a CSRF vulnerability (CWE-352) in its web UI that exposes the administrator passphrase change action without proper CSRF protections. An attacker capable of inducing an authenticated global administrator to visit a crafted link or page can exploit this flaw to change the administrator's passphrase to an attacker-controlled value. This vulnerability has a CVSS 4.0 base score of 8.4, indicating high severity. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation allows an attacker to change the global administrator's passphrase without their consent, potentially leading to unauthorized administrative access and control over the WatchGuard Dimension system. This compromises the confidentiality and integrity of the administrative credentials and the system managed by the administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid visiting untrusted links or pages while authenticated to the WatchGuard Dimension web UI. Implementing additional protective controls such as web application firewalls or monitoring for suspicious activity may help mitigate risk.