CVE-2025-3716 - Vulnerability Details - OpenCVE

Description

User enumeration in ESET Protect (on-prem) via Response Timing.

Published: 2026-03-30

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ESET, spol. s.r.o

ESET Protect (on-prem)

unaffected

Version	Status	Constraints
`12.1.1.0`	unaffected	—

No data.

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00016.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://help.eset.com/changelogs/?product=protect&lang=en-US

History

Mon, 30 Mar 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 30 Mar 2026 08:15:00 +0000

Type	Values Removed	Values Added
Description		User enumeration in ESET Protect (on-prem) via Response Timing.
Title		User enumeration in ESET Protect (on-prem)
Weaknesses		CWE-204
References		https://help.eset.com/changelogs/?product=protect&lang=en-US
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: ESET

Published: 2026-03-30T07:30:30.707Z

Updated: 2026-03-30T15:19:53.699Z

Reserved: 2025-04-16T08:51:43.823Z

Link: CVE-2025-3716

Vulnrichment

Updated: 2026-03-30T15:19:40.537Z

NVD

Status : Awaiting Analysis

Published: 2026-03-30T08:16:16.380

Modified: 2026-03-30T13:26:07.647

Link: CVE-2025-3716

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-204

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3716", "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "state": "PUBLISHED", "assignerShortName": "ESET", "dateReserved": "2025-04-16T08:51:43.823Z", "datePublished": "2026-03-30T07:30:30.707Z", "dateUpdated": "2026-03-30T15:19:53.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "shortName": "ESET", "dateUpdated": "2026-03-30T07:30:30.707Z"}, "title": "User enumeration in ESET Protect (on-prem)", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-204", "description": "CWE-204 Observable response discrepancy", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-172", "descriptions": [{"lang": "en", "value": "CAPEC-172 Manipulate Timing and State"}]}], "affected": [{"vendor": "ESET, spol. s.r.o", "product": "ESET Protect (on-prem)", "versions": [{"status": "unaffected", "version": "12.1.1.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "User enumeration in ESET Protect (on-prem) via\u00a0Response Timing.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "User enumeration in ESET Protect (on-prem) via Response Timing."}]}], "references": [{"url": "https://help.eset.com/changelogs/?product=protect&lang=en-US", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T15:18:46.243056Z", "id": "CVE-2025-3716", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T15:19:53.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3716", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T15:18:46.243056Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T15:19:40.537Z"}}], "cna": {"title": "User enumeration in ESET Protect (on-prem)", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-172", "descriptions": [{"lang": "en", "value": "CAPEC-172 Manipulate Timing and State"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ESET, spol. s.r.o", "product": "ESET Protect (on-prem)", "versions": [{"status": "unaffected", "version": "12.1.1.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://help.eset.com/changelogs/?product=protect&lang=en-US", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "User enumeration in ESET Protect (on-prem) via\u00a0Response Timing.", "supportingMedia": [{"type": "text/html", "value": "User enumeration in ESET Protect (on-prem) via Response Timing.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204 Observable response discrepancy"}]}], "providerMetadata": {"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "shortName": "ESET", "dateUpdated": "2026-03-30T07:30:30.707Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3716", "state": "PUBLISHED", "dateUpdated": "2026-03-30T15:19:53.699Z", "dateReserved": "2025-04-16T08:51:43.823Z", "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "datePublished": "2026-03-30T07:30:30.707Z", "assignerShortName": "ESET"}, "dataVersion": "5.2"}