Vulnerability Intelligence Report
Trimble Cityworks Deserialization Vulnerability
CVE-2025-0994
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
8.6
HIGH
EPSS Probability:27.43%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-502 ↗CWE-502 Deserialization of Untrusted Data
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Trimble | Cityworks | 0 < 15.8.9 (affected) |
| Trimble | Cityworks (with office companion) | 0 < 23.10 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS) · CERT · USA |
| Reserved | 2025-02-03T18:03:05 |
| Published | 2025-02-06T16:01:20 |
| Patch Date | 2025-02-06 |
| Last Updated | 2025-10-21T22:55:30 |
Community Chatter & Buzz