CVE-2025-43017

CRITICAL

HP ThinPro 8.1 - Privilege Escalation

Title source: llm

Description

HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.

References (1)

Core 1

Core References

Vendor Advisory

https://support.hp.com/us-en/document/ish_13164593-13164617-16/hpsbhf04066

Scores

CVSS v3 9.8

EPSS 0.0022

EPSS Percentile 12.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-250

Status published

Products (1)

hp/thinpro 8.1 sp2 (6 CPE variants)

Published Oct 28, 2025

Tracked Since Feb 18, 2026