Hackers Exploit Cityworks Flaw: A Comedy of Errors for IIS Servers!
Hackers are exploiting a Cityworks deserialization vulnerability, CVE-2025-0994, to execute remote commands on IIS servers, deploying Cobalt Strike for network access. Trimble advises immediate updates and warns against overprivileged IIS permissions. CISA emphasizes securing systems, while Microsoft notes similar breaches through exposed ASP.NET machine keys.
Hot Take:
Trimble’s Cityworks vulnerability: the latest must-have accessory for hackers wanting to crash the municipal party. With Cobalt Strike beacons popping up like unwanted mushrooms, it’s time for local governments to roll up their sleeves and patch like their city’s budget depends on it. Because, spoiler alert, it does!
Key Points:
- Trimble warns of a Cityworks deserialization vulnerability being exploited for remote command execution.
- The vulnerability, CVE-2025-0994, holds a severity score of 8.6 and affects Microsoft IIS servers.
- Cityworks versions prior to 15.8.9 and 23.10 are vulnerable; updates are available for patching.
- Hackers are deploying Cobalt Strike beacons and other tools via the vulnerability.
- Administrators need to check for overprivileged IIS permissions and incorrect directory configurations.
Already a member? Log in here