CVE-2025-3716

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

User enumeration in ESET Protect (on-prem) via Response Timing.

Metrics

CVSS 4.0 5.3/10CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-204

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 30, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-371606.5A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privCVE-2025-371617.5A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial CVE-2025-371628.8A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injectioCVE-2025-371637.2A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authentCVE-2025-371649.8A remote code execution issue exists in HPE OneView.CVE-2025-371657.5A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintendedCVE-2025-371667.5A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet cCVE-2025-371689.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. SucceCVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could alloCVE-2025-37172.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the sameCVE-2025-371707.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371717.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s
CVE-2025-3716: Medium severity, CVSS 5.3 | Vulnix