First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-3716

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

User enumeration in ESET Protect (on-prem) via Response Timing.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
ESET, spol. s.r.o	ESET Protect (on-prem)	—

References

https://help.eset.com/changelogs/?product=protect&lang=en-US

Timeline

Published: Mar 30, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-371606.5A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low priv CVE-2025-371617.5A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial CVE-2025-371628.8A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injectio CVE-2025-371637.2A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authent CVE-2025-371649.8A remote code execution issue exists in HPE OneView.CVE-2025-371657.5A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended CVE-2025-371667.5A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet c CVE-2025-371689.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Succe CVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allo CVE-2025-37172.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same CVE-2025-371707.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371717.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s

CVE-2025-3716: Medium severity, CVSS 5.3 | Vulnix