HP ThinPro 8.1 SP8 Security Updates
Priority LOW 38CWE-250Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-250.
Summary
HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00268 19th percentileScored 2026-11-07
Fix Fixed HP ThinPro 8.1 (HP Inc.): <SP8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packard Enterprise | HP ThinPro 8.1 | SP1 to before <SP8 | <SP8 | Patch available | CNA |
- HP ThinPro 8.1 VendorHewlett Packard Enterprise Affected SP1 to before <SP8 Fixed in <SP8 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hp:thinpro:8.1:sp2:*:*:*:*:*:* | 8.1 sp2 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp3:*:*:*:*:*:* | 8.1 sp3 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp4:*:*:*:*:*:* | 8.1 sp4 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp5:*:*:*:*:*:* | 8.1 sp5 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp6:*:*:*:*:*:* | 8.1 sp6 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp7:*:*:*:*:*:* | 8.1 sp7 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:o:hp:thinpro:8.1:sp2:*:*:*:*:*:* Versions 8.1 sp2 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp3:*:*:*:*:*:* Versions 8.1 sp3 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp4:*:*:*:*:*:* Versions 8.1 sp4 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp5:*:*:*:*:*:* Versions 8.1 sp5 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp6:*:*:*:*:*:* Versions 8.1 sp6 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp7:*:*:*:*:*:* Versions 8.1 sp7 Vulnerable ·Hewlett Packard Enterprise
Remediation
- Fix · CNA HP ThinPro 8.1 (HP Inc.) Fixed in <SP8
Timeline
- 2026-10-02 Threatist record created from CVE-2025-43017
- 2026-10-03 Alias added: GHSA-2mmx-jx99-8cmf
References
More Hewlett Packard Enterprise Thinpro vulnerabilities
- TI-2019-13631 OS command injection in Hewlett Packard Enterprise ThinPro Linux CVSS 3.1HIGH 8.0
- TI-2017-01982 A potential security vulnerability has been identified with the command line shell of the… CVSS 3.0HIGH 7.8
- TI-2016-02041 HP ThinPro 4.4 through 6.1 mishandles the keyboard layout control panel and virtual… CVSS 3.0HIGH 7.8
- TI-2019-13632 OS command injection in Hewlett Packard Enterprise ThinPro Linux CVSS 3.1MEDIUM 6.8
- TI-2019-12261 In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the… CVSS 3.1MEDIUM 6.8
- TI-2022-01472 A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2025-43017 · CVE Program
- CVE-2025-43017 · NVD
- FIRST EPSS
- GHSA-2mmx-jx99-8cmf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences