Trimble’s Cityworks Zero-Day: A Comedy of Vulnerabilities and Overprivileged IIS Permissions
Trimble Cityworks has a high-severity vulnerability, CVE-2025-0994, allowing remote code execution via a deserialization issue. Though requiring authentication, threat actors have exploited it to deliver malware like Cobalt Strike. Trimble urges customers to update to version 15.8.9 or 23.10 to patch this zero-day vulnerability.
Hot Take:
Looks like Trimble’s Cityworks is in the spotlight for all the wrong reasons! Who knew an innocent-sounding “deserialization issue” could wreak such havoc? Maybe it’s time for Cityworks to take a city-wide vacation until this mess is sorted out. Because when a zero-day vulnerability parties like it’s 2025, things get wild—literally!
Key Points:
- Trimble’s Cityworks suffers from a critical zero-day vulnerability (CVE-2025-0994).
- The flaw permits remote code execution on Microsoft’s IIS web server.
- CISA issued an advisory, although Cityworks doesn’t directly control industrial processes.
- Exploitation requires authentication but has been linked to Cobalt Strike deployment.
- Trimble released patches for Cityworks versions 15.8.9 and 23.10.
Already a member? Log in here