CVE-2025-34121 is an unauthenticated arbitrary file upload vulnerability in Idera Up.Time Monitoring Station (up to version 7.2). The vulnerability exists in the wizards/post2file.php script, which improperly handles POST parameters, allowing attackers to upload malicious PHP files to the webroot directory. Successful exploitation results in remote code execution with the privileges of the web server user. This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-306 (Missing Authentication for Critical Function). The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary code remotely on the affected system with the privileges of the web server user. This can lead to full system compromise, data theft, or disruption of service. The critical CVSS score of 9.3 reflects the high severity and potential impact on affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is released, restrict access to the vulnerable script if possible and monitor for suspicious activity related to file uploads. Follow vendor communications closely for updates.