CVE-2026-78617: CWE-203 in WatchGuard Dimension

CVE-2026-78617 describes a vulnerability in WatchGuard Dimension 2.0 where the web login endpoint lacks default enforcement of rate-limiting or account lockout mechanisms. This configuration weakness permits remote attackers to conduct automated password guessing attacks against user accounts. The account lockout feature can mitigate brute-force attacks but requires manual enabling, as it is disabled by default. There is no vendor advisory indicating a patch or official fix at this time.

The vulnerability allows remote attackers to attempt automated password guessing attacks without restriction, potentially leading to unauthorized access if weak credentials are used. The risk is mitigated if the account lockout setting is enabled, but since it is disabled by default, many deployments may be exposed. No known exploits are reported in the wild.

Enable the account lockout setting in WatchGuard Dimension to block brute-force attempts after a defined number of failed login attempts. Since no official patch or fix is currently available, this configuration change is the primary mitigation. Monitor vendor advisories for updates regarding patches or additional mitigations.