Auth bypass in Idera Up.time Monitoring Station
CVE-2025-34121
An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted…
Vulnerability class: Unrestricted File Upload
EPSS: 0.806 (99.2th percentile) — read the EPSS interpretation.
Affected products
- Idera Up.time Monitoring Station — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/m… (exploit)
- web.archive.org/web/20150210113937/http://www.security-assessment.com/files/doc… (third-party-advisory, exploit)
- www.exploit-db.com/exploits/38732 (exploit)
- www.vulncheck.com/advisories/idera-uptime-arbitrary-file-upload-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34121?
- CVE-2025-34121 is a vulnerability in Idera Up.time Monitoring Station, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-07-16.
- Is CVE-2025-34121 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.