CVE-2025-8352 in PROTECT On-Prem
Summary
by MITRE • 10/06/2026
Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The identified vulnerability in ESET PROTECT On-Prem represents a classic instance of improper resource management, specifically categorized under CWE-770: Allocation of Resources Without Limits or Throttling. This flaw allows an attacker to trigger actions that consume excessive system resources without any built-in safeguards such as rate limiting, quotas, or throttling mechanisms in place. In the context of enterprise security platforms like ESET PROTECT On-Prem, which serve as central hubs for managing endpoint protection policies and monitoring network health, the availability of these services is critical. When a vulnerability allows for unbounded resource consumption, it directly undermines the reliability and stability of the entire security infrastructure managed by the platform.
From a technical perspective, this flaw typically manifests when specific API endpoints or administrative functions process requests without validating the size, complexity, or frequency of incoming data. An attacker can exploit this by sending specially crafted requests that force the server to allocate disproportionate amounts of Central Processing Unit (CPU) cycles and Random Access Memory (RAM). For example, a request might trigger an inefficient algorithmic operation, such as a recursive function with no base case check under certain conditions, or it may initiate a large-scale data aggregation process without pagination limits. As these operations proceed, the server's resource usage spikes dramatically, potentially exhausting available memory pools and causing CPU saturation across multiple cores.
The operational impact of this vulnerability is severe, primarily leading to a Denial-of-Service (DoS) condition. When system resources are exhausted, legitimate administrative users may find themselves unable to access the ESET PROTECT On-Prem console, effectively blinding security operations teams to real-time threats and policy management capabilities. In high-load environments, this can also cause cascading failures where dependent services or databases become unresponsive due to lack of available memory or connection timeouts. This disruption not only halts routine administrative tasks but also prevents the timely deployment of critical security patches or threat intelligence updates, leaving endpoints vulnerable during a period when protection is most needed.
This type of vulnerability aligns with several tactics within the MITRE ATT&CK framework, particularly those related to Resource Hijacking and Impact categories. Attackers may leverage this flaw as part of a broader campaign to disrupt organizational operations rather than for data exfiltration or persistence. By degrading system performance, adversaries can create chaos that distracts security teams from other malicious activities occurring simultaneously on the network. Furthermore, in cloud-native deployments where resources are dynamically allocated based on demand, such exploitation could lead to increased operational costs due to auto-scaling triggers responding to false positive load signals caused by the attack traffic.
Mitigation strategies for this vulnerability focus primarily on applying vendor-provided patches that introduce proper input validation and resource constraints. Administrators should ensure their ESET PROTECT On-Prem instances are updated to versions where these allocation limits have been enforced. In addition to patching, defensive measures include implementing network-level rate limiting using firewalls or load balancers to restrict the frequency of requests from single sources. Deploying Web Application Firewalls (WAF) with rules tuned to detect abnormal resource consumption patterns can also help mitigate exploitation attempts before they reach the application layer. Regular monitoring of system metrics for anomalous spikes in CPU and memory usage is essential for early detection, allowing security teams to isolate affected components or block malicious IP addresses promptly.