CVE-2025-43017 HP ThinPro 8.1 SP8 Security Updates

What is CVE-2025-43017?

CVE-2025-43017 is a high-severity authentication bypass vulnerability in HP ThinPro 8.1, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.

Weakness: CWE-250

Which versions are affected by CVE-2025-43017?

It affects 1 product.

Products include Hp Thinpro.

How do I fix CVE-2025-43017?

No fix has been published for CVE-2025-43017 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-43017 being exploited?

There is no known exploitation of CVE-2025-43017 in the wild and no public exploit code.

Other vulnerabilities in HP ThinPro 8.1

• CVE-2019-18909 Command injection in ThinPro Linux High 8.0
• CVE-2017-2740 Privilege escalation in HP ThinPro High 7.8
• CVE-2016-2246 Privilege escalation in n/a High 7.8
• CVE-2019-16287 Privilege escalation in ThinPro Linux Medium 6.8
• CVE-2019-18910 Command injection in ThinPro Linux Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2mmx-jx99-8cmf.