Eset Protect On Prem
Monthly
Denial-of-service in ESET PROTECT On-Prem allows remote, unauthenticated attackers to exhaust CPU and RAM resources by sending crafted requests, leading to availability degradation. This moderate-severity issue affects the on-premises management console and requires network reachability to the server's listening service; no public exploit code has been identified, and a vendor patch is available per the ESET advisory. The CVSS 4.0 base score is 6.9, but our independent assessment rates it as a moderate availability-only risk (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
ESET Protect (on-premises) allows user enumeration through response timing analysis, enabling remote attackers to determine whether specific usernames exist in the system without authentication. This information disclosure vulnerability (CWE-204) exploits timing differences in authentication responses to distinguish valid users from invalid ones, potentially facilitating targeted attacks against known accounts.
Denial-of-service in ESET PROTECT On-Prem allows remote, unauthenticated attackers to exhaust CPU and RAM resources by sending crafted requests, leading to availability degradation. This moderate-severity issue affects the on-premises management console and requires network reachability to the server's listening service; no public exploit code has been identified, and a vendor patch is available per the ESET advisory. The CVSS 4.0 base score is 6.9, but our independent assessment rates it as a moderate availability-only risk (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
ESET Protect (on-premises) allows user enumeration through response timing analysis, enabling remote attackers to determine whether specific usernames exist in the system without authentication. This information disclosure vulnerability (CWE-204) exploits timing differences in authentication responses to distinguish valid users from invalid ones, potentially facilitating targeted attacks against known accounts.