PT-2025-5829 · Trimble+1 · Trimble Cityworks+1

Trimble

·

Published

2025-02-06

·

Updated

2026-05-08

·

CVE-2025-0994

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Trimble Cityworks versions prior to 15.8.9 Trimble Cityworks with office companion versions prior to 23.10
Description A deserialization vulnerability could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server. This issue is being actively exploited, and it poses a significant risk to municipalities and infrastructure agencies that use Trimble Cityworks to manage public assets. The vulnerability allows attackers to gain unauthorized access and deploy harmful payloads like Cobalt Strike and VShell.
Recommendations Trimble Cityworks versions prior to 15.8.9: Update to version 15.8.9 or later to fix the deserialization vulnerability. Trimble Cityworks with office companion versions prior to 23.10: Update to version 23.10 or later to fix the deserialization vulnerability. As a temporary workaround, consider restricting access to the vulnerable Cityworks software until a patch is applied.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-02720
CVE-2025-0994

Affected Products

Internet Information Services
Trimble Cityworks