HP Thinpro vulnerabilities

9 CVEs affecting HP Thinpro, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-43017, published 2025-10-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-18909, published 2019-11-22. High severity, CVSS 8.0. EPSS: 2.2% chance of exploitation in the next 30 days. The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.
CVE-2019-16287, published 2019-11-22. Medium severity, CVSS 6.8. EPSS: 0.7% chance of exploitation in the next 30 days. In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerability to gain privileged access to create a file on the local file system whose…
CVE-2019-18910, published 2019-11-22. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with local user privileges.
CVE-2016-2246, published 2016-12-29. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. HP ThinPro 4.4 through 6.1 mishandles the keyboard layout control panel and virtual keyboard application, which allows local users to bypass intended access restrictions and gain privileges via…
CVE-2017-2740, published 2018-01-23. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. A potential security vulnerability has been identified with the command line shell of the HP ThinPro operating system 6.1, 5.2.1, 5.2, 5.1, 5.0, and 4.4. The vulnerability could result in a local…
CVE-2025-43024, published 2025-10-28. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A GUI dialog of an application allows to view what files are in the file system without proper authorization.
CVE-2025-43017, published 2025-10-28. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.
CVE-2022-1602, published 2022-09-13. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). The security vulnerability in SP8 is not remedied after upgrading from SP8 to Service Pack 9 (SP9). HP…
CVE-2024-1174, published 2024-03-01. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.0 SP 8, which includes updates to mitigate potential…