CVE-2025-43017 is a critical (CVSS 9.8) flaw in HP ThinPro 8.1. The system management application failed to verify the user's true identity. HP has released HP ThinPro 8.1 SP8 with updates that address it, so move affected thin clients to SP8 and read HP's bulletin.
What's affected
HP ThinPro 8.1, per the record. ThinPro is the Linux based operating system on HP thin clients. The affected piece is the system management application, which the record says did not verify the user's true id.
The weakness is tagged CWE-250, execution with unnecessary privileges. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no privileges, no user interaction, and high impact on all three security properties. That is the profile of a flaw that needs little to start.
The fixed version named by HP in the record is HP ThinPro 8.1 SP8. The record does not say whether earlier ThinPro releases are affected, so check the HP bulletin for the full list. The bulletin is on HP's support site and may need a browser, since it blocked my automated fetch.
How to check if you're exposed
Find which thin clients run ThinPro 8.1 and which service pack they have. HP Device Manager or your endpoint management tool should list the operating system build for each device. On an individual device, the system information screen shows the ThinPro version.
If you cannot tell the service pack, treat the device as needing the update. HP's bulletin, reference HPSBHF04066, is the source for exact steps and for the affected hardware list.
Also check which of these devices are reachable from outside the office network, since the score assumes network access and no login.
What to do now
- Inventory thin clients and group them by ThinPro version.
- Read HP's security bulletin for CVE-2025-43017 and note the affected models.
- Roll out ThinPro 8.1 SP8 to affected devices, starting with those on shared or less trusted networks.
- Until they are updated, keep management interfaces off the open internet and restrict them to admin networks.
- Confirm the version on a sample of updated devices to make sure the rollout took.
- Add thin clients to your regular patch review. They are easy to forget because users rarely touch them.
Why it matters
Thin clients often sit in front of sensitive systems such as virtual desktops, call centre tools and point of sale apps. A flaw in how the management application checks who is asking can give someone control that was meant for administrators. The record keeps the detail short, and so does this post.
The record does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog (KEV). The record was published on 28 October 2025, so check HP's page for any later guidance. Fix first by updating, since the score is critical and the fix is available.
Quick check
Which release fixes CVE-2025-43017?
The record says HP released HP ThinPro 8.1 SP8 with updates to mitigate the issue. Use that release and check HP's bulletin for any other affected builds.
Is it exploited in the wild?
The record does not say so, and it does not list the CVE in CISA KEV. Treat it as a high priority patch regardless, because of the critical score.
Sources
- Gold entry for CVE-2025-43017
- Gold entry for CWE-250
- HP security bulletin HPSBHF04066, listed in the CVE record
HP's support site blocked my automated fetch, so the details above come from the CVE record. Read the bulletin itself for the full list of affected models.
Last reviewed: 18 October 2026.
