CVE-2025-34121
Idera Up.Time ≤ 7.2 post2file.php Arbitrary File Upload RCE
Severity Score
9.3
*CVSS v4
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
3
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in remote code execution as the web server user. NOTE: The bypass for this vulnerability is tracked as CVE-2015-9263.
*Credits:
Denis Andzakovic of Security-Assessment.com
CVSS Scores
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
System
Vulnerable | Subsequent
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2025-04-15 CVE Reserved
- 2025-07-16 CVE Published
- 2025-07-17 CVE Updated
- 2025-07-17 First Exploit
- 2025-07-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-306: Missing Authentication for Critical Function
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://www.vulncheck.com/advisories/idera-uptime-arbitrary-file-upload-rce | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Idera Search vendor "Idera" | Up.Time Monitoring Station Search vendor "Idera" for product "Up.Time Monitoring Station" | <= 7.2 Search vendor "Idera" for product "Up.Time Monitoring Station" and version " <= 7.2" | en |
Affected
|