ZeroDay Findings
Sign inSign up

Findings

CVE-2025-0994

Trimble Cityworks Deserialization Vulnerability

Published Feb 6, 2025 · updated Jun 17, 2026 · trimble cityworks

Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 6, 2025 · Catalog

    Detected

    Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.

  2. Feb 7, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Feb 28, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Feb 28, 2025

Affected

  • cpe trimble/cityworksversion unspecified
  • vendor Trimble Cityworksversion unspecified

Sources

  • CISA KEVCVE-2025-0994

    Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.

    cisa.gov
  • CVE.orgCVE-2025-0994

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-0994

    30-day exploitation probability 31.1%

    first.org
  • NIST NVDCVE-2025-0994

    Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Infor

    nvd.nist.gov

References