CVE-2025-0994 - Trimble Cityworks Deserialization Vulnerability

Trimble | Cityworks

• Date Added:
• 2025-02-07

• Due Date:
• 2025-02-28

Vulnerability Name

Trimble Cityworks Deserialization Vulnerability

Description

Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?; https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0994

Related News Articles

Hackers exploit Cityworks RCE bug to breach Microsoft IIS serversFebruary 8, 2025