Eset Protect On Prem EUVD-2025-209122

Without a published CVSS score or vector, quantitative severity cannot be directly assessed. However, the vulnerability presents moderate real-world risk: user enumeration is a precursor to brute-force and targeted phishing attacks, yet requires active analysis to exploit and does not directly compromise confidentiality, integrity, or availability of user data. The attack vector is network-based and requires no authentication, lowering the barrier to reconnaissance. The impact is limited to information disclosure (username validation), not account compromise or code execution. Prioritization depends on deployment context: organizations with sensitive or unique usernames may see higher risk from enumeration. This is not a critical vulnerability but merits timely remediation to eliminate reconnaissance pathways.

A remote attacker sends a series of login requests with varying usernames while measuring response times. By analyzing statistical differences in response latency between valid and invalid usernames, the attacker compiles a list of confirmed users in the ESET Protect environment. This enumerated user list is then used to seed targeted phishing campaigns or brute-force attacks against specific accounts. The attack requires no prior authentication and can be performed at network speed, making it a low-friction reconnaissance technique.