Home / Items
VulnerabilityKnown exploitedExploit likelihood 31%
Trimble Cityworks Deserialization Vulnerability
CVE-2025-0994 · CISA KEV · February 7, 2025
Summary
Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.
From CISA, quoted as published. Check the source before acting.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA required action, quoted.
Affected products
| Vendor | Product |
|---|---|
| Trimble | Cityworks |
Why it's on these mode pages
- Highway and motor carrier: Vendor table: Trimble (matched by rule)
Change history
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com