CVE-2025-0994

Trimble Cityworks, a GIS-based asset management platform used largely by local governments and utilities, contains a deserialization vulnerability (CWE-502). An authenticated user triggers the flaw by submitting maliciously crafted serialized input to the Cityworks web application. Successful exploitation yields remote code execution on the underlying Microsoft IIS web server hosting the product. Any organization running Cityworks on IIS is affected, especially where the server is internet-facing. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-02-07, confirming exploitation in the wild; no public PoC is known, CVSS scoring is pending, and EPSS assigns roughly a 31% probability of exploitation within 30 days.

What to do: Patch or apply Trimble's mitigations to all Cityworks/IIS servers per vendor instructions, as required by the CISA KEV listing, and discontinue use if mitigations are unavailable. Because exploitation requires authentication, review and rotate Cityworks accounts and credentials, and inspect IIS/application logs on exposed servers for signs of compromise (ransomware use is unconfirmed but possible).