A flaw in the ExampleNodeService.asmx of ShuoRen Smart Heating Integrated Management Platform allows an attacker to upload arbitrary files without any validation. This unrestricted upload weakness can enable an adversary to place malicious files on the server, potentially resulting in remote code execution or other unintended operations, depending on the server configuration and the files uploaded. The vulnerability is categorized as a combination of CWE‑284 (Access Control) and CWE‑434 (Unrestricted Upload of File with Dangerous Type).

The platform version affected is ShuoRen Smart Heating Integrated Management Platform 1.0.0. Users running this exact version are susceptible; no other versions are listed as affected.

The CVSS score of 6.9 indicates medium severity, while the EPSS below 1% suggests a low probability of exploitation in the current environment, though the exploit has already been published. The vulnerability can be triggered remotely via the web service endpoint, and the denial of vendor response enhances the risk. The absence of a KEV listing means it is not yet in the CISA Known Exploited Vulnerabilities catalog, but the public availability of an exploit elevates its threat posture.