CVE-2025-34121 describes an unauthenticated arbitrary file upload vulnerability in Idera Up.Time Monitoring Station (<=7.2). The vulnerability exists in the wizards/post2file.php script, which improperly handles POST parameters, enabling attackers to upload malicious PHP files to the webroot. Successful exploitation results in remote code execution with the privileges of the web server user. The vulnerability is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-306 (Missing Authentication for Critical Function). No official patch or remediation details are provided in the available data. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical impact.

Exploitation allows unauthenticated attackers to upload arbitrary PHP files to the webroot, resulting in remote code execution as the web server user. This can lead to full compromise of the affected system under the web server's privileges. The vulnerability does not require authentication and has a low attack complexity, making it highly exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected script and consider disabling or restricting file upload functionality in the wizards/post2file.php script. Monitor for suspicious file uploads and remove any unauthorized files found in the webroot.