Dive Brief:
- The Cybersecurity and Infrastructure Security Agency warned hackers are targeting a vulnerability in Trimble Cityworks that could allow an attacker to conduct remote code execution.
- The deserialization vulnerability, tracked as CVE-2025-0994, can enable an attacker to conduct remote code execution against a user’s Microsoft Internet Information Services web server, according to the CISA advisory.
- Trimble discovered the vulnerability after it was warned about third-party attempts to gain access to certain Cityworks deployments, a spokesperson told Cybersecurity Dive via email.
Dive Insight:
Trimble Cityworks is asset management software used to help organize various projects, including local government, utilities, airports and other types of facilities.
After investigating the warnings of third-party exploitation, the company issued a patch for the affected versions, the spokesperson said.
Trimble warned customers that some on-premises deployments may have overprivileged Internet Information Services identity permissions. Trimble advised that IIS should not be run “with local or domain level administrative privileges on any site.”
CISA added the vulnerability to its known exploited vulnerabilities catalog.
Researchers from Symantec warned that a range of tools were being used in threat activity, including Cobalt Strike, variants of privilege escalation tool GodPotato and JavaScript reconnaissance tools, according to a document seen by Cybersecurity Dive.
