CVE-2025-0994
Trimble Cityworks Deserialization Vulnerability
Description
CVE-2025-0994 is a high-severity deserialization vulnerability in Trimble Cityworks, a widely used asset management and work order platform for government and utility organizations. The flaw allows an authenticated user to execute arbitrary code remotely on the customer's Microsoft Internet Information Services (IIS) web server. With a CVSS v3.1 base score of 8.8 and an exceptionally high EPSS score of 77.80% at the 99th percentile, this vulnerability represents one of the most actively targeted threats in the current landscape. CISA has added CVE-2025-0994 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 28, 2025, and affected organizations must update Cityworks to version 15.8.9 or later, or Cityworks with Office Companion to version 23.10 or later.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trimble | cityworks | < 15.8.9; >= 23.0, < 23.10 |
References
- https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?(Vendor Advisory)
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0994(US Government Resource)
Weakness Type
Insecure Deserialization
CVE-2025-0994 is a deserialization vulnerability in Trimble Cityworks. While no specific CWE has been formally assigned, the vulnerability aligns with insecure deserialization patterns where the application processes serialized object data from untrusted or insufficiently validated sources. When the Cityworks application deserializes attacker-crafted data, it can be manipulated to instantiate arbitrary objects and execute malicious code on the IIS web server. Insecure deserialization in .NET applications running on IIS is a well-understood attack class that frequently enables remote code execution through gadget chains present in common .NET framework libraries.
Impact Analysis
CVE-2025-0994 poses an extreme risk to organizations running Trimble Cityworks, particularly government agencies and utility companies that rely on the platform for critical infrastructure asset management. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the vulnerability is exploitable over the network with low complexity, requiring only low-privilege (authenticated user) access and no user interaction. Confidentiality (High): Successful exploitation grants the attacker code execution on the IIS web server, providing access to the Cityworks database containing asset management data, work orders, geographic information, citizen data, and potentially connected systems. Government organizations may have sensitive infrastructure data, utility maps, and maintenance records exposed. Integrity (High): Remote code execution on the IIS server allows modification of asset management records, work orders, and configuration data. An attacker could manipulate infrastructure maintenance schedules, alter utility records, install persistent backdoors, or pivot to connected systems within the organization's network. Availability (High): The attacker can disrupt Cityworks operations by crashing the IIS application, corrupting databases, encrypting files, or consuming server resources, directly impacting the organization's ability to manage critical infrastructure assets and respond to service requests. The EPSS score of 77.80% at the 99th percentile is exceptionally high, indicating near-certain exploitation activity. Ransomware use is currently listed as unknown, but government and utility organizations are prime targets for ransomware groups.
Exploit Maturity
CVE-2025-0994 demonstrates very high exploit maturity with confirmed active exploitation. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog and issued an ICS advisory (ICSA-25-037-04), confirming active exploitation targeting Trimble Cityworks deployments. The EPSS score of 77.80% at the 99th percentile places this among the most likely-to-be-exploited vulnerabilities currently tracked, indicating widespread active targeting. The deserialization attack class against .NET applications on IIS is well-established, with mature tooling and gadget chains publicly available (such as ysoserial.net), making exploitation reliable once the specific deserialization entry point is identified. The fact that Cityworks is primarily deployed by government agencies and utility companies makes it a high-value target for both nation-state actors and financially motivated threat groups. Trimble has published a customer communication acknowledging the vulnerability and active exploitation. Ransomware association is currently listed as unknown.
Remediation
-
Update Trimble Cityworks to a patched version immediately. Upgrade Cityworks to version 15.8.9 or later for on-premises deployments, or upgrade Cityworks with Office Companion to version 23.10 or later. Review the Trimble customer communication and the CISA ICS advisory for detailed update instructions and specific version requirements.
-
Audit IIS server configurations and harden the web application. Review IIS application pool settings to ensure Cityworks runs with minimal necessary privileges. Implement Web Application Firewall (WAF) rules to filter suspicious serialized payloads. Disable unnecessary .NET serialization endpoints and restrict deserialization to known safe types where possible.
-
Conduct a forensic investigation on exposed Cityworks servers. Review IIS logs, Windows Security event logs, and network traffic for indicators of compromise, including unusual deserialization activity, unexpected process creation by the IIS worker process (w3wp.exe), anomalous outbound connections, or unauthorized file modifications. Check for web shells, scheduled tasks, or new user accounts that may indicate prior exploitation.
-
Implement network segmentation and access controls. Restrict network access to Cityworks servers from untrusted networks. Place the Cityworks IIS server behind a reverse proxy with strict access controls, and limit authenticated user access to only those personnel who require it for their role. Implement multi-factor authentication for all Cityworks user accounts.
-
Establish ongoing vulnerability monitoring for Cityworks. Subscribe to Trimble security communications and CISA ICS advisories for timely notification of future vulnerabilities. Include Cityworks servers in regular vulnerability scanning and penetration testing activities, with particular attention to deserialization and web application vulnerabilities.
Technical Details
CVE-2025-0994 is a deserialization vulnerability in Trimble Cityworks that enables remote code execution on the hosting Microsoft IIS web server. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-based exploitation with low complexity, low-privilege authentication requirement, no user interaction needed, and complete impact on confidentiality, integrity, and availability. The technical root cause lies in how the Cityworks application handles deserialization of user-supplied data. In .NET applications, deserialization converts serialized byte streams back into runtime objects. When an application deserializes data from an untrusted source without proper type validation or restrictions, an attacker can craft a malicious serialized payload containing a chain of .NET objects (known as a "gadget chain") that, when deserialized, trigger arbitrary code execution. The .NET framework contains numerous classes that perform dangerous operations during deserialization, such as process execution or file system access. By crafting a serialized payload that references these classes in the correct sequence, an attacker can achieve code execution within the context of the IIS application pool identity, which typically runs with elevated privileges on the web server. Trimble Cityworks versions prior to 15.8.9 and Cityworks with Office Companion versions prior to 23.10 fail to adequately restrict which types can be deserialized, allowing malicious gadget chains to execute. The affected versions span both the standard Cityworks product line (below 15.8.9) and the Cityworks with Office Companion product line (versions 23.0 through below 23.10).
Frequently Asked Questions
Is CVE-2025-0994 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2025-0994 in both the Known Exploited Vulnerabilities catalog and an ICS advisory. Trimble has also acknowledged active exploitation in a customer communication. The EPSS score of 77.80% at the 99th percentile indicates this is among the most actively targeted vulnerabilities currently tracked.
What organizations are most at risk from CVE-2025-0994?
Trimble Cityworks is primarily used by government agencies, municipalities, and utility companies for managing critical infrastructure assets, work orders, and geographic information. Organizations in these sectors running vulnerable versions of Cityworks are at highest risk and should prioritize patching immediately.
How do I fix CVE-2025-0994?
Update Cityworks to version 15.8.9 or later for standard deployments, or to version 23.10 or later for Cityworks with Office Companion. Review the Trimble customer communication and CISA ICS advisory ICSA-25-037-04 for specific update instructions and additional hardening recommendations.
What can an attacker do by exploiting CVE-2025-0994?
Successful exploitation allows an authenticated attacker to execute arbitrary code on the IIS web server hosting Cityworks. This can lead to complete server compromise, including access to the Cityworks database, lateral movement to connected systems, installation of persistent backdoors, data theft, and potential disruption of critical infrastructure management operations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.