CVE-2012-1195: Lenovo ThinkManagement Console ServerSetup unrestricted file upload RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable remote code execution with a very high EPSS score, though no confirmed in-the-wild exploitation is recorded.

What it is

The ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 exposes an anonymous endpoint (core.anonymous/ServerSetup.asmx) that accepts a PutUpdateFileCore command inside a RunAMTCommand SOAP request without restricting the uploaded file's extension. An attacker can upload a file with an executable extension and then request it directly from the web root, achieving remote code execution. The flaw is an access-control failure (CWE-264) in a service that requires no authentication.

Impact

An unauthenticated remote attacker can place and execute arbitrary code on the server hosting the ThinkManagement Console, gaining the privileges of the web service process and potentially full control of the management host.

Attack surface

Reached over the network via SOAP requests to the anonymous ServerSetup.asmx endpoint; the CVSS vector (AV:N/AC:L/Au:N) and the 'core.anonymous' path indicate no authentication is required, and no user interaction is described.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high (0.684, 99.3rd percentile), indicating substantial predicted exploitation activity.

What to do

• Apply the vendor fix for ThinkManagement Console 9.0.3 or upgrade to a supported release; the record does not name a specific patch version, so confirm with Lenovo/LANDesk advisories.
• Restrict network access to the ServerSetup.asmx endpoint and the management console web service to trusted administrative networks only.
• Disable or remove the anonymous ServerSetup web service if it is not required for operations.
• Enforce upload validation that rejects executable extensions and stores uploaded files outside the web root.
• Run the web service under a least-privilege account so uploaded code cannot execute with elevated rights.

Detection

• Monitor web server and SOAP request logs for RunAMTCommand or PutUpdateFileCore calls to ServerSetup.asmx, especially from unexpected source addresses.
• Alert on files with executable extensions (for example .aspx, .asp, .exe, .dll) appearing in the console web root or upload directories.
• Watch for direct HTTP GET requests to newly written files under the web root shortly after SOAP upload activity.
• Baseline and review outbound or child processes spawned by the ThinkManagement Console web service for signs of uploaded payload execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.