HP ThinPro CVE-2025-43024

Exploitation requires LOCAL, interactive access to an HP ThinPro 8.1 (SP2-SP7) device and the ability to invoke the specific application GUI dialog that lists filesystem contents; the flaw is that this dialog performs no authorization check before displaying files (AV:L/PR:N/UI:N). Limiting factors: this is not remotely reachable over the network, impact is confined to read-only disclosure of file/directory listings (VC:L, no integrity or availability impact), and realistic risk depends on how the thin client is deployed - kiosk/locked-down public terminals where any walk-up user can reach the dialog are most exposed, whereas devices behind physical controls or restricted sessions are less so. The provided data does not name the exact dialog or enumerate which files are exposed, so defenders should consult HP advisory HPSBHF04066 to confirm the affected component.

This is a moderate, locally-scoped information-disclosure issue (CWE-497, Exposure of Sensitive System Information) in HP ThinPro, not a high-urgency remote threat. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N, base 5.1) is internally consistent with the description: a GUI dialog exposes the filesystem listing, so the attack is LOCAL (requires interacting with the device's UI, not a network request), low complexity, needs no authentication, and produces only a LOW confidentiality impact with no integrity or availability effect. The exploitation-maturity metric is undefined (E:X), and there is no CISA KEV listing and no POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' EPSS reinforces low real-world exploitation pressure (0.28%, 18th percentile). The only signals that are present (CVSS, EPSS) agree that this is a low-to-moderate priority: a genuine but limited local info-leak, not a high-CVSS-but-overblown issue nor an actively exploited emergency. The main caveat is the vague description ('a GUI dialog of an application'), which does not name the exact dialog or specify what files/metadata are revealed - this limits precise impact scoping and should be confirmed against HP advisory HPSBHF04066.

A user or kiosk-mode operator sitting at an HP ThinPro thin client opens an application's GUI dialog (such as a file-open/browse dialog) that is reachable without logging in or elevating privileges, and uses it to enumerate files and directories across the local filesystem that should have been off-limits. Because the access vector is local and no authentication is required (AV:L/PR:N/UI:N), the attacker only needs hands-on or interactive session access to the device; no public exploit code is required or known. The disclosed listing could reveal sensitive paths or configuration locations useful for further targeting.