CVE-2019-18909: OS Command Injection
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-18909?
CVE-2019-18909 is a vulnerability in the VPN software within HP ThinPro that does not safely handle user supplied input, allowing an attacker to inject commands with root privileges.
What is the severity of CVE-2019-18909?
The severity of CVE-2019-18909 is high, with a severity value of 8.
Which software versions are affected by CVE-2019-18909?
The affected software versions are HP ThinPro 6.2, 6.2.1, 7.0, and 7.1.
How can an attacker exploit CVE-2019-18909?
An attacker can exploit CVE-2019-18909 by injecting commands with root privileges through the vulnerable VPN software in HP ThinPro.
Are there any references available for CVE-2019-18909?
Yes, the following references are available for CVE-2019-18909: [Packet Storm Security](http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.html), [Full Disclosure Mailing List](http://seclists.org/fulldisclosure/2020/Mar/39), [HP Support Document](https://support.hp.com/us-en/document/c06509350).