60
CVE-2025-0994
KEVnicheAuthenticated Deserialization RCE in Trimble Cityworks
CISA: Trimble Cityworks Deserialization Vulnerability
CVSS 4.0
8.6 high
EPSS
31%p98
Published
()
KEV added
AI analysis
Trimble Cityworks, a GIS-based asset management platform used largely by local governments and utilities, contains a deserialization vulnerability (CWE-502). An authenticated user triggers the flaw by submitting maliciously crafted serialized input to the Cityworks web application. Successful exploitation yields remote code execution on the underlying Microsoft IIS web server hosting the product. Any organization running Cityworks on IIS is affected, especially where the server is internet-facing. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-02-07, confirming exploitation in the wild; no public PoC is known, CVSS scoring is pending, and EPSS assigns roughly a 31% probability of exploitation within 30 days.
What to do: Patch or apply Trimble's mitigations to all Cityworks/IIS servers per vendor instructions, as required by the CISA KEV listing, and discontinue use if mitigations are unavailable. Because exploitation requires authentication, review and rotate Cityworks accounts and credentials, and inspect IIS/application logs on exposed servers for signs of compromise (ransomware use is unconfirmed but possible).
Affected
| Trimble Cityworks | — |
Estimated exposure
nicheroughly hundreds to low thousands of deployments, concentrated at local governments, utilities and public agencies (estimate; no public install counts… — Cityworks is GIS-based asset management software sold almost exclusively to municipal, utility and other public-sector customers, and no published active-install or internet-exposure counts were available, so the estimate reflects that…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
CISA Known Exploited Vulnerability
- Affected
- Trimble Cityworks
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Unknown
- Vendors
- trimble
- Products
- cityworks
- Weakness
- CWE-502
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news13 stories
60
60
60
60
60
60
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [10 February]
60
60
60
60
60
Recorded Future Announces Automated Signature Creation, Accelerating Vulnerability Prioritization
Recorded Future launched Automated Signature Creation in ASI, turning new CVEs into deployable detection signatures in as little as 31 minutes.
Recorded Future announced Automated Signature Creation within its Attack Surface Intelligence product, autonomously generating production-ready detection signatures for newly surfaced vulnerabilities in as little as 31 minutes. The platform correlates an organization's internet-facing assets, live threat activity (malware, ransomware, actor intent), and vulnerability intelligence to prioritize which CVEs warrant detection. The company reports a tenfold increase in in-platform signatures and maps the capability to the four prioritization criteria in CISA's June 2026 directive on risk-based vulnerability mitigation.
32