Trimble Cityworks Deserialization Vulnerability (CVE-2025-0994)

Historical catalog analysis: CISA added this entry on February 07, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-0994 is a deserialization vulnerability (CWE-502) identified in Trimble Cityworks. This flaw could allow an authenticated user to execute arbitrary code remotely against the Microsoft Internet Information Services (IIS) web server hosting the application.

Exposure and applicability

This vulnerability applies to organizations utilizing Trimble Cityworks deployed on Microsoft IIS web servers. Because exploitation requires authentication, the primary exposure path is through users who already possess valid credentials for the system. Infrastructure owners should identify all instances of Cityworks in their environment and verify if they are running on IIS to determine applicability.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize actions based on the level of access granted to authenticated users within the application:

1. Apply Vendor Mitigations: The primary corrective action is to implement mitigations as specified by Trimble. This should be the first priority for all affected systems.
2. Evaluate Product Continuity: In scenarios where vendor-supplied mitigations are unavailable or cannot be applied, organizations should evaluate whether to discontinue use of the product to eliminate the risk of remote code execution.
3. Access Review: While not a direct fix for the deserialization flaw, reviewing and limiting the number of users with authenticated access to the Cityworks environment could reduce the pool of potential attackers who can trigger this vulnerability.

How to validate remediation

Verification must go beyond a simple version check or the presence of a patch. To assure that exposure has been reduced, defenders should:

• Confirm Mitigation Deployment: Verify through configuration audits or vendor-provided tools that the specific mitigation steps have been successfully applied to the IIS server.
• Verify Functional Constraints: If the mitigation involves disabling a specific feature or changing how data is handled during deserialization, validate that these constraints are active in the production environment.

Limits and open questions

It remains unknown whether this vulnerability has been utilized by ransomware campaigns. Additionally, while CISA has mandated a remediation deadline of February 28, 2025, for federal agencies, this date is not a universal requirement for non-federal organizations.

Residual risk persists if the underlying deserialization mechanism remains active but is shielded by other controls; only the application of vendor-supported mitigations or removal of the software addresses the root cause. The effectiveness of any compensating control depends on the specific nature of the authenticated access required to trigger the flaw.

Source and editorial note

CVE-2025-0994: Trimble Cityworks Deserialization Vulnerability · Source date: February 07, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 10, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 25, 2026 at 00:43 UTC.

Request a Vulnerability Assessment