The vulnerability in ESET Protect (on‑prem) allows an attacker to enumerate valid usernames by measuring the response time to authentication attempts. This information disclosure can enable targeted password guessing or credential stuffing attacks, compromising the confidentiality of user accounts. The weakness is classified under CWE‑204.

The flaw affects ESET Protect (on‑prem) deployments. No specific product versions are listed, implying the issue may be present across multiple or all on‑prem releases available at the time of disclosure.

The CVSS score is 5.3, indicating a moderate severity. Exploit probability data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires network access to the ESET Protect management interface, and the response‑timing technique suggests that an attacker can exploit the vulnerability remotely without additional privileges.