CVEvulnerability
CVE-2019-18909
8.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-11-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.0 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.7 HIGH — AV:A/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.
Affected configurations
• hp thinpro 6.2
• hp thinpro 6.2.1
• hp thinpro 7.0
• hp thinpro 7.1
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Mar/39 Mailing List, Third Party Advisory
- https://support.hp.com/us-en/document/c06509350 Vendor Advisory
- http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Mar/39 Mailing List, Third Party Advisory
- https://support.hp.com/us-en/document/c06509350 Vendor Advisory