CVE-2025-0994

CVE Enrichment

CVSS: 8.6 HIGH
EPSS: 31.09%
EPSS Percentile: 98.24%
CISA KEV: YES — Known Exploited Vulnerability

Description

Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: ics-cert@hq.dhs.gov
Published: 06-Feb-2025 23:15
Last Modified: 17-Jun-2026 15:27
EPSS Date: 2026-10-12
CWE: CWE-502

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:H /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CISA KEV Details

Date Added: 2025-02-07
Remediation Due: 2025-02-28
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?; https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0994

Affected Products / Versions

trimble / cityworks
Version / affected range: * · before (exclusive) 15.8.9
cpe:2.3:a:trimble:cityworks:*:*:*:*:*:*:*:*
trimble / cityworks
Version / affected range: * · from (inclusive) 23.0 · before (exclusive) 23.10
cpe:2.3:a:trimble:cityworks:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 23:12
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

For example, in February 2025 we reported on the Trimble Cityworks: CVE-2025-0994, showcasing how manual signature creation worked. Recorded Future Automates Vulnerability Detection Signature Creation in 31 Minutes
CVE-2025-0994, Trimble Cityworks Darktrace’s Mid-Year Review Finds AI-Enabled Phishing, SaaS Ransomware and Ongoing Vulnerability Exploitation

CVE (7)

Malware (9)

People (9)

Threat Actors (7)

Vendors (7)

Products (11)

Tools (3)

Industries (5)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.