{"id":"CVE-2025-0994","published":"2025-02-06T16:15:41Z","modified":"2026-06-17T08:27:29Z","title":"Trimble Cityworks Deserialization Vulnerability","vendor":"Trimble","product":"Cityworks","tier":"core","eol":null,"description":{"text":"Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.","provenance":"source","from":"NVD"},"summary":{"text":"The Trimble Cityworks deserialization flaw affects Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10, where untrusted data is deserialized. An authenticated user with network access can exploit it, without user interaction, to execute code remotely on the customer's Microsoft IIS web server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:35Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.31309,"percentile":0.98273,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-02-07","dueDate":"2025-02-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?; https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0994","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-02-06","exploitedFirstSeen":"2025-02-06","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04","date":"2025-02-06"},{"url":"https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-06-docx/0?","date":"2025-02-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-02-07"},{"url":"https://www.recordedfuture.com/blog/trimble-cityworks-cve-2025-0994-vulnerability-analysis","date":"2025-02-19"},{"url":"https://blog.talosintelligence.com/uat-6382-exploits-cityworks-vulnerability/","date":"2025-05-22"},{"url":"https://fortiguard.fortinet.com/threat-signal-report/5997","date":"2025-05-23"},{"url":"https://www.broadcom.com/support/security-center/protection-bulletin/tetraloader-distributed-in-the-uat-6382-campaign","date":"2025-05-23"},{"url":"https://www.darktrace.com/blog/2025-cyber-threat-landscape-darktraces-mid-year-review","date":"2025-08-05"},{"url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0828.pdf","date":"2025-08-28"},{"url":"https://hs-21289959.f.hubspotemail.net/hubfs/21289959/Annual%20Threat%20Landscape%20Report_2025.pdf","date":"2026-01-19"}],"evidenceTotal":14,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0994","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Deserialization of Untrusted Data","mappingType":"exploitation_technique","evidence":[],"comment":"A deserialization vulnerability in Trimble Cityworks versions before 15.8.9 (and Cityworks with Office Companion versions prior to 23.10) can be exploited by attackers using maliciously crafted serialized objects to the server, ending with escalated privileges permitting the execution remote code against a target's Microsoft IIS web server.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Deserialization of Untrusted Data","mappingType":"primary_impact","evidence":[],"comment":"A deserialization vulnerability in Trimble Cityworks versions before 15.8.9 (and Cityworks with Office Companion versions prior to 23.10) can be exploited by attackers to execute remote code against a target web server.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-1955","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1955","exploited":true,"exploitedSince":"2025-02-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-02-07","earliestUrl":"https://github.com/rxerium/CVE-2025-0994","repos":[{"name":"rxerium/CVE-2025-0994","url":"https://github.com/rxerium/CVE-2025-0994","stars":4,"created":"2025-02-07"}]},"first":{"date":"2025-02-07","source":"PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-0994"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2025-02-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0994","provenance":"source"},{"date":"2025-02-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04","provenance":"source"},{"date":"2025-02-07","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-0994","provenance":"source"},{"date":"2025-02-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-02-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1955","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1},"priority":{"score":68.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 631 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.65,"detail":"percentile 0.9827"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}