CVE-2025-43017CWE-250

CVE-2025-43017

Critical · published October 29, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

⚡ A sneaky flaw in HP ThinPro 8.1 lets users bypass identity checks—like allowing someone to borrow a library book without showing their library card! 📚 Think of the HP ThinPro system as a library where every visitor needs a membership card. If the system doesn't check the ID properly, anyone could waltz in and check out valuable information as if they were a registered member! An attacker could potentially gain unauthorized access to the system and manipulate settings, posing a substantial risk to data integrity and privacy. This could lead to serious security breaches, including unauthorized data exposure or even system downtime, which could be absolutely devastating for organizations relying on this platform.

Put simply

Think of the HP ThinPro system as a library where every visitor needs a membership card. If the system doesn't check the ID properly, anyone could waltz in and check out valuable information as if they were a registered member! The vulnerability arises because the HP ThinPro 8.1 system management application fails to properly verify a user's true identity, allowing unauthorized access to sensitive system functions.

What to do

An attacker could potentially gain unauthorized access to the system and manipulate settings, posing a substantial risk to data integrity and privacy. This could lead to serious security breaches, including unauthorized data exposure or even system downtime, which could be absolutely devastating for organizations relying on this platform. HP has released HP ThinPro 8.1 SP8 to address this issue. It's crucial to update to this version as soon as possible to ensure that users' identities are accurately verified and the system is secure. Regular audits of user access permissions are also recommended to bolster security. You've got this! By updating now, you'll enhance your security and keep your systems running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2025-10-29T01:15Z
Affected products (6)
ProductVersionsFixed in
hp/thinproall versions—
hp/thinproall versions—
hp/thinproall versions—
hp/thinproall versions—
hp/thinproall versions—
hp/thinproall versions—
References (1)
EPSS history
Timeline
  • 28 OCT 20:40Z
    HP ThinPro 8.1 SP8 Security Updates
    cvelistv5