VulnerabilityModified
CVE-2019-18909
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.
HIGH 8.0EPSS 2.18%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.
- CVSS 3.1
- 8.0 HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.18% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- hp/thinpro
- Source
- hp-security-alert@hp.com
References
- http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Mar/39Mailing List, Third Party Advisory
- https://support.hp.com/us-en/document/c06509350Vendor Advisory
- http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Mar/39Mailing List, Third Party Advisory
- https://support.hp.com/us-en/document/c06509350Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.