CVE Daily

CVE-2025-34121

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time M...

Critical CVSS 9.3

Overview

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in remote code execution as the web server user. NOTE: The bypass for this vulnerability is tracked as CVE-2015-9263.

CWE: CWE-306 Published: 2025-07-16T21:15:27.100
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.3 (CRITICAL)
  • Detected tags: rce, upload (tag impact: VERY HIGH)

Recommended actions:

  • Patch/upgrade immediately (remote code execution).
  • Reduce exposure (WAF/segmentation), minimize attack surface.
  • Restrict types/MIME, store outside web root, inspect content.

Recommended tools

Tags