CVE-2025-0994highunder attackCWE-502

CVE-2025-0994: high-severity vulnerability in Trimble Cityworks

Published · Updated

Follow this CVE+ Monitor Cityworks

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

83Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.6epss 31%
from disclosure to weapon1 day
Published on NVDFeb 6
1st PoC+1d
CISA KEV+1d
Action required by CISAfederal deadline: 2025-02-28

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Trimble Cityworks allows authenticated users to execute malicious code on the web server through a deserialization flaw. This means attackers with valid login credentials can take control of the server and run arbitrary commands.

Technical detail

CWE-502 unsafe deserialization vulnerability in Trimble Cityworks (<15.8.9) and Office Companion (<23.10) enables authenticated remote code execution on IIS servers. The attack requires valid user credentials and exploits improper handling of serialized objects to achieve arbitrary code execution with server privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Trimble · CityworksTrimble · Cityworks (with office companion)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.