What is CVE-2025-34121?

CVE-2025-34121 is a vulnerability in Idera Up.time Monitoring Station, classified under Missing Authentication for Critical Function. Published 2025-07-16.

Is CVE-2025-34121 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Idera Up.time Monitoring Station

CVE-2025-34121

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in remote code execution as the web server user. NOTE: The bypass for this vulnerability is tracked as CVE-2015-9263.

Vulnerability class: Broken Authentication

EPSS: 0.017 (74.6th percentile) — read the EPSS interpretation.

Affected products

Idera Up.time Monitoring Station — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

rapid7/metasploit-framework

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit, third-party-advisory)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2025-34121?: CVE-2025-34121 is a vulnerability in Idera Up.time Monitoring Station, classified under Missing Authentication for Critical Function. Published 2025-07-16.
Is CVE-2025-34121 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.