CVE-2025-34121CWE-306CWE-434

Idera Up.Time ≤ 7.2 post2file.php Arbitrary File Upload RCE

Critical · published July 16, 2025

CVSS v4.0
9.3
EPSS
3%
Percentile
86.4
In the wild
Unconfirmed
What it is

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in remote code execution as the web server user. NOTE: The bypass for this vulnerability is tracked as CVE-2015-9263.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02809 · 86.4th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-07-16T21:06Z
EPSS history
Timeline
  • 16 JUL 21:06Z
    Idera Up.Time ≤ 7.2 post2file.php Arbitrary File Upload RCE
    cvelistv5