Description
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined number of failed attempts, but this setting is not enabled by default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WatchGuard | Dimension | 2.0 – < 2.3.1 | 2.3.1 |
References
- https://psirt.watchguard.com/CVE-2026-78617 vendor-advisory