CVE ID
CVE-2025-0994
Vulnerability Name
Trimble Cityworks Deserialization Vulnerability
- Project: Trimble
- Product: Cityworks
Date
- Date Added: 2025-02-07
- Due Date: 2025-02-28
Description
Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.
Known To Be Used in Ransomware Campaigns?
Unknown
Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?; https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0994
Related Security News
- China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing
- Chinese hackers breach US local governments using Cityworks zero-day
- Hackers exploit Cityworks RCE bug to breach Microsoft IIS servers
Top comments (0)