CVE-2025-1697: hp, inc. hp touchpoint analytics service Link Following

Vulnerability summary

CVE-2025-1697 is a high (CVSS 7.8) Link Following vulnerability in hp, inc. hp touchpoint analytics service. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.2% of scored vulnerabilities.

Timeline

1. 18-04-2025
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This vulnerability could potentially allow a local attacker to escalate privileges. HP is providing software updates to mitigate this potential vulnerability.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.