Trimble Cityworks Deserialization Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-02-07
• EPSS: 31% chance of exploitation in the next 30 days (higher than 98% of CVEs)

[ Description ]Official description

Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.

CISA: Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 28 Feb 2025): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-…Vendor Advisory
• www.cisa.gov/news-events/ics-advisories/icsa-25-037-04Third Party AdvisoryUS Government Resource
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource