Cityworks Security Flaw: Cyber Chaos or Just Another Tuesday?
CISA has raised alarms about a Trimble Cityworks security flaw now being exploited. The vulnerability, CVE-2025-0994, could enable remote code execution. Trimble has issued patches, but cyber attackers are already on the prowl. Users, update your software now—because who doesn’t love a good game of cyber cat-and-mouse?
Hot Take:
Looks like Cityworks is living up to its name by causing quite a bit of “city work” for its users! This latest security exploit is like finding out your reliable GPS is actually a mole for the cybercrime cartel, directing hackers straight to your digital doorstep. Time to patch things up before your assets become a hacker’s new treasure trove!
Key Points:
– CISA warns of active exploitation of a security flaw in Trimble Cityworks software.
– The vulnerability, CVE-2025-0994, allows remote code execution on IIS web servers.
– Affected versions include Cityworks prior to 15.8.9 and Cityworks with office companion prior to 23.10.
– Trimble has issued patches, but real-world attacks continue.
– The exploit involves a Rust-based loader and Go-based remote access tool, VShell.