HP ThinPro
CVE-2025-43017
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session on thin client
-
DeliveryInvoke System management application
-
ExploitAbuse missing true-identity check
-
ExecutionExecute privileged operations as system
-
ImpactFull compromise of thin client
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Requires a local, authenticated low-privileged session (PR:L, AV:L) on an affected HP ThinPro 8.1 device at service pack SP2 through SP7; the attacker must be able to invoke the System management application, which executes with unnecessary privileges and fails to verify the caller's true identity (CWE-250). Limiting factors: there is no remote attack surface (local access only), the attacker must already hold a valid low-privileged account on the thin client, and devices patched to SP8 are not affected. No user interaction by a victim is required (UI:N). |
| Impact | This is a credible but non-urgent privilege-escalation issue rather than a top-tier emergency. The HP-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description and CWE-250 (Execution with Unnecessary Privileges): a locally present, low-privileged user ('failed to verify user's true id') abuses the System management application to gain full confidentiality, integrity, and availability impact - a local-to-root style escalation on the thin client. The signals converge toward 'real but gated': the local attack vector (AV:L) and required privileges (PR:L) inherently limit the attacker population to those already able to run code on the device, which is why the score sits at 8.5 (high) rather than critical despite triple-high impact. Supporting exploitation signals are weak: EPSS is only 0.27% (17th percentile), there is no CISA KEV listing, and no public exploit code was identified. No signals conflict - low EPSS, absent KEV, and a local-only vector all agree this is not a mass-exploitation candidate. Priority should be driven by how exposed the affected thin clients are (shared kiosks, multi-user VDI endpoints) rather than by raw severity. |
| Exploit ScenarioDerived | A low-privileged user with an interactive session on an HP ThinPro 8.1 (SP2-SP7) thin client - for example a kiosk or shared VDI endpoint - invokes the System management application, which fails to properly verify the caller's real identity. Because the application executes with unnecessary privileges (CWE-250), the user leverages this to perform administrative actions and escalate to full control of the device. No public exploit code was identified at time of analysis, and exploitation requires prior local access and an existing low-privileged account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Local privilege escalation in HP ThinPro 8.1 (System management application) allows an authenticated low-privileged user to execute code with elevated privileges because the service does not verify the caller's true identity, classified under CWE-250 (Execution with Unnecessary Privileges). Affected builds are HP ThinPro 8.1 service packs SP2 through SP7; devices updated to SP8 are not affected. The attack is local-only, requires an existing low-privileged account on the thin client, and needs no victim interaction, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1 7.8). Exploitation is not confirmed in the wild: no KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.27% (17th percentile), making this a credible but non-urgent privilege-escalation issue.
RemediationAI
Upgrade affected thin clients to HP ThinPro 8.1 SP8, the vendor-released patch that remediates CVE-2025-43017 per HP Security Bulletin HPSBHF04066 (https://support.hp.com/us-en/document/ish_13164593-13164617-16/hpsbhf04066); verify the installed service pack level after imaging or OTA updates to confirm SP8 is applied. If immediate fleet-wide upgrade is not possible, treat this as a local privilege-escalation risk and apply compensating controls: restrict who can log into the thin clients at all (only fully trusted operators, since any valid low-privileged account is sufficient to trigger the flaw), tighten physical access to endpoints to prevent unauthorized local sessions, and limit or disable normal-user access to the System management application and any shortcuts or scripts that invoke it while the upgrade is staged, accepting that this degrades standard administrative workflows. Because exploitation requires an already-authenticated local account and no remote vector exists, monitoring for unexpected privilege changes or configuration tampering by standard users on SP2-SP7 devices provides a practical detection layer until SP8 is deployed. No vendor-released workaround other than the SP8 update is specified in the available data.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the HP ThinPro 8.1 System management application, a privileged component of the thin-client OS that performs administrative configuration tasks. Under CWE-250, this component executes with unnecessary (elevated) privileges and fails to validate the true identity of the invoking user, so any local caller with a valid low-privileged session can leverage the service's authority to act with administrative rights. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and the independent CVSS:3.1 assessment (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both describe an unauthenticated-at-network-layer, locally-triggered escalation with no special attack complexity and no user interaction, but with substantial impact once reached. CPE data pins the exposure to the HP ThinPro 8.1 operating system across service packs SP2, SP3, SP4, SP5, SP6, and SP7; there is no remote attack surface, and the underlying issue is a missing identity/authorization check on a privileged management interface rather than a memory-safety or injection flaw.
Know when Thinpro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local privilege escalation by an existing low-privileged user, so AV:L and PR:L; no identity check makes it reliable (AC:L), yielding full C/I/A on the device with no scope change.
Primary rating from Vendor (hp).
CVSS VectorVendor: hp
DescriptionCVE.org
HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.
Executive ViewAI
HP ThinPro 8.1 thin clients running service packs SP2 through SP7 carry a high-severity local privilege-escalation flaw in the system management application that lets an existing low-privileged user obtain elevated rights, with high confidentiality, integrity, and availability impact. Because the flaw is local-only and requires a pre-existing account on the device, exposure is concentrated in environments where end users or contractors have interactive access to thin-client endpoints, such as clinical, kiosk, or shared-workspace fleets. Leadership should care because unmanaged endpoint privilege escalation can be used as a foothold for lateral movement and persistent access, though there is no public exploit identified at time of analysis and exploitation is not confirmed actively exploited (CISA KEV).
No vendor-released patch for SP2-SP7 identified at time of analysis; upgrade to HP ThinPro 8.1 SP8 is the remediation path. Interim mitigations: restrict and minimize local low-privileged accounts on affected thin clients, enforce physical and session access controls on shared endpoints, apply least-privilege and application allowlisting controls, and monitor for anomalous privilege escalation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to
The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker t
HP ThinPro 4.4 through 6.1 mishandles the keyboard layout control panel and virtual keyboard application, which allows l
In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerabi
A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). Rated medium severity (CV
Information disclosure in HP ThinPro 8.1 (service packs SP2 through SP7) allows anyone with local access to the thin cli
GitHub PoC
Exploit-DB