CVE-2025-3716 - Vulnerability Details - OpenCVE

User enumeration in ESET Protect (on-prem) via Response Timing.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Eset	Eset Protect

No data.

No data.

References

Link	Providers
https://help.eset.com/changelogs/?product=protect&lang=en-US

History

Wed, 01 Apr 2026 02:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Eset Eset eset Protect
Vendors & Products		Eset Eset eset Protect

Mon, 30 Mar 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 30 Mar 2026 08:15:00 +0000

Type	Values Removed	Values Added
Description		User enumeration in ESET Protect (on-prem) via Response Timing.
Title		User enumeration in ESET Protect (on-prem)
Weaknesses		CWE-204
References		https://help.eset.com/changelogs/?product=protect&lang=en-US
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: ESET

Published: 2026-03-30T07:30:30.707Z

Updated: 2026-03-30T15:19:53.699Z

Reserved: 2025-04-16T08:51:43.823Z

Link: CVE-2025-3716

Vulnrichment

Updated: 2026-03-30T15:19:40.537Z

NVD

Status : Awaiting Analysis

Published: 2026-03-30T08:16:16.380

Modified: 2026-03-30T13:26:07.647

Link: CVE-2025-3716

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3716", "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "state": "PUBLISHED", "assignerShortName": "ESET", "dateReserved": "2025-04-16T08:51:43.823Z", "datePublished": "2026-03-30T07:30:30.707Z", "dateUpdated": "2026-03-30T15:19:53.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "shortName": "ESET", "dateUpdated": "2026-03-30T07:30:30.707Z"}, "title": "User enumeration in ESET Protect (on-prem)", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-204", "description": "CWE-204 Observable response discrepancy", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-172", "descriptions": [{"lang": "en", "value": "CAPEC-172 Manipulate Timing and State"}]}], "affected": [{"vendor": "ESET, spol. s.r.o", "product": "ESET Protect (on-prem)", "versions": [{"status": "unaffected", "version": "12.1.1.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "User enumeration in ESET Protect (on-prem) via\u00a0Response Timing.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "User enumeration in ESET Protect (on-prem) via Response Timing."}]}], "references": [{"url": "https://help.eset.com/changelogs/?product=protect&lang=en-US", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T15:18:46.243056Z", "id": "CVE-2025-3716", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T15:19:53.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3716", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T15:18:46.243056Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T15:19:40.537Z"}}], "cna": {"title": "User enumeration in ESET Protect (on-prem)", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-172", "descriptions": [{"lang": "en", "value": "CAPEC-172 Manipulate Timing and State"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ESET, spol. s.r.o", "product": "ESET Protect (on-prem)", "versions": [{"status": "unaffected", "version": "12.1.1.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://help.eset.com/changelogs/?product=protect&lang=en-US", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "User enumeration in ESET Protect (on-prem) via\u00a0Response Timing.", "supportingMedia": [{"type": "text/html", "value": "User enumeration in ESET Protect (on-prem) via Response Timing.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204 Observable response discrepancy"}]}], "providerMetadata": {"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "shortName": "ESET", "dateUpdated": "2026-03-30T07:30:30.707Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3716", "state": "PUBLISHED", "dateUpdated": "2026-03-30T15:19:53.699Z", "dateReserved": "2025-04-16T08:51:43.823Z", "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "datePublished": "2026-03-30T07:30:30.707Z", "assignerShortName": "ESET"}, "dataVersion": "5.2"}