CVE-2012-1195

CVE-2012-1195 describes an unrestricted file upload vulnerability in Lenovo ThinkManagement Console 9.0.3, specifically within the ServerSetup web service. This flaw allows remote, unauthenticated attackers to upload files with executable extensions via a SOAP request, leading to arbitrary code execution. The vulnerability carries a CVSS score of 7.5, indicating high severity with network-based attacks and low complexity, potentially resulting in complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, exploit modules are publicly available in Metasploit and ExploitDB, suggesting a high likelihood of exploitation, despite minimal community discussion or media coverage.