Vulnerability record · CVE-2012-1196 · published 18 February 2012
CVE-2012-1196: Lenovo ThinkManagement Console path traversal in VulCore web service
Landesk · Lenovo Thinkmanagement Console
The VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 does not properly sanitize the filename parameter in a SetTaskLogByFile SOAP request, allowing directory traversal via .. sequences. An unauthenticated remote attacker can use this to delete arbitrary files on the server, which can disrupt the management console and potentially the systems it manages.
Description
Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. (dot dot) in the filename parameter in a SetTaskLogByFile SOAP request.
AV:N/AC:L/Au:N/C:N/I:P/A:N
Automated analysis
high priorityUnauthenticated remote file deletion with a high EPSS score and no KEV listing, but the CVSS impact is limited to integrity and the product is an older management console.
What it is
The VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 does not properly sanitize the filename parameter in a SetTaskLogByFile SOAP request, allowing directory traversal via .. sequences. An unauthenticated remote attacker can use this to delete arbitrary files on the server, which can disrupt the management console and potentially the systems it manages.
Impact
An attacker can delete arbitrary files on the host running the ThinkManagement Console, causing data loss, service disruption, or denial of service. The CVSS vector shows no confidentiality impact and no availability impact, only partial integrity impact, so the practical effect is limited to file deletion.
Attack surface
The flaw is reachable over the network through the SOAP endpoint WSVulnerabilityCore/VulCore.asmx. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
CVE-2012-1196 is not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.55495, 98.989th percentile), but the reference tags only include a Vendor Advisory and no public exploit or PoC is cited in the record.
What to do
- Apply the vendor fix referenced in the Secunia advisory (SA47666) or any Lenovo update for ThinkManagement Console 9.0.3.
- If patching is not possible, restrict network access to the VulCore.asmx SOAP endpoint to trusted management hosts only.
- Validate and canonicalize the filename parameter server-side, rejecting any path containing .. or absolute paths.
- Run the ThinkManagement Console service with least privilege and ensure it cannot write to or delete files outside its required directories.
- Monitor and back up critical files on the console host so deletions can be detected and restored.
Detection
- Inspect SOAP requests to WSVulnerabilityCore/VulCore.asmx for filename parameters containing .. or path separators.
- Alert on unexpected deletion or modification of files on the ThinkManagement Console host, especially outside application directories.
- Monitor web server and application logs for SetTaskLogByFile requests from untrusted or unusual source IPs.
- Use file integrity monitoring on the console host to detect removal of system or application files.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-1196 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-1196), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
