EUVD-2025-211031
GHSA-rv35-5p8c-8vrh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ESET PROTECT server over network
-
DeliverySend unbounded/crafted requests
-
ExploitTrigger uncontrolled CPU/RAM allocation
-
ExecutionExhaust server resources
-
ImpactDenial of service of management console
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an ESET PROTECT On-Prem server's listening service; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction are needed against a default-reachable deployment. The practical limiting factors are: impact is restricted to availability degradation (CPU/RAM exhaustion, VA:L) with no data compromise, and exposure depends on whether the console is network- or internet-accessible rather than firewalled to trusted administrative networks. No special product feature or non-default configuration is named in the advisory description as a prerequisite. |
| Impact | This is a moderate-severity availability-only issue, not a top priority despite its network-facing nature. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remote, low-complexity, unauthenticated attack path, but the impact is confined to partial availability (VA:L) with zero confidentiality or integrity impact (VC:N/VI:N) - consistent with CWE-770 (uncontrolled resource consumption causing CPU/RAM exhaustion). No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation; the only exploitation-relevant signal is the raw CVSS, which overstates urgency relative to a pure resource-exhaustion DoS. There is no SSVC decision data supplied. Net: a legitimate patch-management item for ESET PROTECT On-Prem operators, but it is a high-reachability/low-impact issue rather than a critical threat, and should be prioritized below any confidentiality/integrity or actively-exploited bugs. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a volume of crafted requests to an internet- or network-reachable ESET PROTECT On-Prem server, causing unbounded CPU and RAM allocation. Sustained requests exhaust server resources and degrade or deny the management console's availability. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Denial-of-service in ESET PROTECT On-Prem allows remote, unauthenticated attackers to exhaust CPU and RAM resources by sending crafted requests, leading to availability degradation. This moderate-severity issue affects the on-premises management console and requires network reachability to the server's listening service; no public exploit code has been identified, and a vendor patch is available per the ESET advisory. The CVSS 4.0 base score is 6.9, but our independent assessment rates it as a moderate availability-only risk (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
RemediationAI
Apply the vendor-released patch as directed by the ESET advisory (https://support.eset.com/en/ca8854-eset-customer-advisory-denial-of-service-vulnerability-in-eset-protect-on-prem-fixed); the advisory likely specifies the exact fixed version. Until patching is possible, restrict network access to the ESET PROTECT On-Prem server to trusted administrative networks via firewall rules or network segmentation, as the vulnerability requires network reachability to the listening service. This mitigation reduces exposure but may limit legitimate remote administration capabilities. Additionally, monitor CPU and RAM usage for anomalous spikes that could indicate exploitation attempts, and consider rate-limiting or throttling at the network perimeter if feasible.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-770 (Allocation of Resources Without Limits or Throttling) is the root cause: the application fails to impose adequate limits on resource consumption when handling certain requests, allowing an attacker to cause excessive CPU and RAM usage. ESET PROTECT On-Prem is a centralized management console for ESET endpoint security products, typically deployed on a server that listens on network interfaces. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, and no user interaction, meaning the vulnerability can be triggered remotely without authentication. The impact is limited to availability (VA:L), with no confidentiality or integrity impact. The CPE wildcard suggests all versions may be affected, but the vendor advisory should be consulted for specific affected versions and the fixed release.
Know when Eset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote unauthenticated, low-complexity resource-exhaustion with no confidentiality or integrity impact and only partial availability loss, so C:N/I:N/A:L.
Primary rating from Vendor (ESET).
CVSS VectorVendor: ESET
DescriptionCVE.org
Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
WinRAR for Windows contains a path traversal vulnerability allowing crafted archives to execute arbitrary code, discover
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to ex
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete file
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.
The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. Rated critical
Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certifi
Exploit-DB