CVE-2025-0994: Trimble Cityworks Deserialization Vulnerability Enables Authenticated Remote Code Execution
What It Is — Trimble Cityworks contains an insecure deserialization flaw that can be triggered by an authenticated user to execute arbitrary code on the underlying Microsoft Internet Information Services (IIS) web server.
Exploitability — The vulnerability requires valid credentials; no public exploit or proof‑of‑concept has been released, but the CVSS score is rated 8.8 (High), indicating a serious risk if an attacker gains access.
Affected Products — Trimble Cityworks (on‑premises or hosted deployments that run on IIS).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for secure development and code‑integrity controls that can be evidenced during audits.
- Highlights the importance of continuous monitoring of application changes and patch status as part of a defensible control‑assurance posture.
- Shows that authentication‑related controls must be coupled with strict privilege segregation to limit the impact of a compromised account.
Recommended Actions
- Apply Trimble’s security patch immediately; verify the patch is deployed across all Cityworks instances.
- Conduct a code‑review of any custom extensions to ensure they do not reuse the vulnerable deserialization logic.
- Enforce least‑privilege access for Cityworks users and rotate credentials for any accounts with web‑application access.
- Enable detailed IIS logging and integrate logs into a SIEM for real‑time detection of anomalous execution attempts.
- Capture evidence of the remediation steps in your control‑mapping repository to support audit readiness.
Source: CISA KEV – CVE‑2025‑0994