HP ThinPro 8.1 SP8 Security Updates
Priority LOW 23CWE-497Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-497.
Summary
A GUI dialog of an application allows to view what files are in the file system without proper authorization.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00277 20th percentileScored 2026-11-07
Fix Fixed ThinPro 8.1 (HP Inc): <SP8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packard Enterprise | ThinPro 8.1 | SP1 to before <SP8 | <SP8 | Patch available | CNA |
- ThinPro 8.1 VendorHewlett Packard Enterprise Affected SP1 to before <SP8 Fixed in <SP8 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hp:thinpro:8.1:sp2:*:*:*:*:*:* | 8.1 sp2 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp3:*:*:*:*:*:* | 8.1 sp3 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp4:*:*:*:*:*:* | 8.1 sp4 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp5:*:*:*:*:*:* | 8.1 sp5 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp6:*:*:*:*:*:* | 8.1 sp6 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:thinpro:8.1:sp7:*:*:*:*:*:* | 8.1 sp7 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:o:hp:thinpro:8.1:sp2:*:*:*:*:*:* Versions 8.1 sp2 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp3:*:*:*:*:*:* Versions 8.1 sp3 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp4:*:*:*:*:*:* Versions 8.1 sp4 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp5:*:*:*:*:*:* Versions 8.1 sp5 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp6:*:*:*:*:*:* Versions 8.1 sp6 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:thinpro:8.1:sp7:*:*:*:*:*:* Versions 8.1 sp7 Vulnerable ·Hewlett Packard Enterprise
Remediation
- Fix · CNA ThinPro 8.1 (HP Inc) Fixed in <SP8
Timeline
- 2026-10-02 Threatist record created from CVE-2025-43024
- 2026-10-03 Alias added: GHSA-8fg8-r2x2-4mv9
References
More Hewlett Packard Enterprise Thinpro vulnerabilities
- TI-2019-13631 OS command injection in Hewlett Packard Enterprise ThinPro Linux CVSS 3.1HIGH 8.0
- TI-2025-27884 HP ThinPro 8.1 SP8 Security Updates CVSS 4.0HIGH 8.5
- TI-2017-01982 A potential security vulnerability has been identified with the command line shell of the… CVSS 3.0HIGH 7.8
- TI-2016-02041 HP ThinPro 4.4 through 6.1 mishandles the keyboard layout control panel and virtual… CVSS 3.0HIGH 7.8
- TI-2019-13632 OS command injection in Hewlett Packard Enterprise ThinPro Linux CVSS 3.1MEDIUM 6.8
- TI-2019-12261 In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the… CVSS 3.1MEDIUM 6.8
Sources
- CVE-2025-43024 · CVE Program
- CVE-2025-43024 · NVD
- FIRST EPSS
- GHSA-8fg8-r2x2-4mv9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences