Trimble Cityworks flaw opens IIS servers to attackers
Trimble confirmed attackers are exploiting CVE-2025-0994 in Cityworks after investigating customer reports; the flaw affects Cityworks versions before 15.8.9 and Cityworks with Office Companion before 23.10. CISA added it to its Known Exploited Vulnerabilities catalog on February 7, 2025.
Cityworks rebuilds serialized data into live objects. An authenticated user can provide data that makes the IIS server run attacker-chosen code instead of restoring the intended object. Trimble confirmed the exploitation has enabled unauthorized access to customer networks.
For local governments, utilities, airports, and public-works teams, an exploited Cityworks server may become a foothold into the network around it. The reporting confirms unauthorized network access, but does not establish compromise of connected operational systems; an application update alone cannot show whether the host or reachable assets were affected.
CVSS 8.8 HIGH: trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. EPSS 31% (98th percentile).
CISA federal remediation date Feb 28 · date passed