CVE-2019-18909

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
HP	ThinPro Linux	6.2; 6.2.1; 7.0; 7.1

References

http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Mar/39Mailing List, Third Party Advisory
https://support.hp.com/us-en/document/c06509350Vendor Advisory
http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Mar/39Mailing List, Third Party Advisory
https://support.hp.com/us-en/document/c06509350Vendor Advisory

Timeline

Published: Nov 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-18917.5A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remot CVE-2019-189106.8The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands th CVE-2019-189127.8A potential security vulnerability has been identified for certain HP printers and MFPs with Troy solutions. For affected printers with Futu CVE-2019-189136.8A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide CVE-2019-189146.1A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site Scripti CVE-2019-189157.8A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulner CVE-2019-189167.8A potential security vulnerability has been identified for HP LaserJet Solution Software (for certain HP LaserJet Printers) which may lead t CVE-2019-189176.5A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout.CVE-2019-18927.5A vulnerability in the Secure Sockets Layer (SSL) input packet processor of Cisco Small Business 200, 300, and 500 Series Managed Switches c CVE-2019-189227.5A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated CVE-2019-189236.1Insufficient content type validation of proxied resources in go-camo before 2.1.1 allows a remote attacker to serve arbitrary content from g CVE-2019-189245.3Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ (and variations),