CVE-2019-18909 Command injection in ThinPro Linux

What is CVE-2019-18909?

CVE-2019-18909 is a high-severity command injection vulnerability in HP ThinPro Linux, published on 22 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.

Weakness: CWE-78

Which versions are affected by CVE-2019-18909?

It affects 1 product.

Products include Hp Thinpro.

How do I fix CVE-2019-18909?

No fix has been published for CVE-2019-18909 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-18909 being exploited?

There is no known exploitation of CVE-2019-18909 in the wild and no public exploit code.

Other vulnerabilities in HP ThinPro Linux

• CVE-2025-43017 HP ThinPro 8.1 SP8 Security Updates High 8.5
• CVE-2017-2740 Privilege escalation in HP ThinPro High 7.8
• CVE-2016-2246 Privilege escalation in n/a High 7.8
• CVE-2019-16287 Privilege escalation in ThinPro Linux Medium 6.8
• CVE-2019-18910 Command injection in ThinPro Linux Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2mcx-9373-6qh4.