Trimble Cityworks Deserialization Vulnerability Leading to IIS Remote Code Execution (CVE-2025-0994)
Executive & SecOps Summary
SECOPS ASSESSMENTTrimble Cityworks versions prior to 15.8.9 and Cityworks with Office Companion versions prior to 23.10
Authenticated attackers can exploit a deserialization vulnerability (CWE-502) to execute arbitrary code with system privileges on the Microsoft IIS web server
Immediately upgrade to patched versions (Cityworks 15.8.9+ or Office Companion 23.10+) and restrict IIS access controls
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security updates provided by Trimble immediately.
# Example backup and preparation commands before applying the update
# 1. Backup the existing Cityworks web directory
tar -czvf cityworks_backup_$(date +%F).tar.gz /inetpub/wwwroot/cityworks
# 2. Deploy the official patch package (15.8.9+ or 23.10+) obtained from Trimble Portal2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict IIS application pool privileges and enforce IP-based access controls.
# Enforce least privilege by setting IIS AppPool Identity to ApplicationPoolIdentity
Import-Module WebAdministration
Set-ItemProperty 'IIS:\AppPools\CityworksAppPool' -Name 'processModel.identityType' -Value 'ApplicationPoolIdentity'
# Restrict access to trusted IP ranges (e.g., 10.0.0.0/8) via IIS IP Security
Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/Default Web Site/cityworks' -filter 'system.webServer/security/ipSecurity' -name '.' -value @{ipAddress='0.0.0.0';subnetMask='255.255.255.255';allowed='false'}
Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/Default Web Site/cityworks' -filter 'system.webServer/security/ipSecurity' -name '.' -value @{ipAddress='10.0.0.0';subnetMask='255.0.0.0';allowed='true'}3. Log Audit & IoC Verification Commands
Scan IIS logs and application event logs for indicators of deserialization exploitation.
# Search IIS log files for common .NET deserialization exception patterns
Get-ChildItem -Path 'C:\inetpub\logs\LogFiles\' -Recurse -Filter '*.log' |
Select-String -Pattern 'SerializationException|ObjectStateFormatter|LosFormatter' |
Select-Object -First 50Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-0994) is a critical deserialization of untrusted data vulnerability (CWE-502) residing within Trimble Cityworks. The root cause lies in the application's failure to properly validate or sanitize serialized objects before deserializing them, allowing arbitrary object injection.
2. Exploitation Mechanics & Attack Scenario
An authenticated attacker can craft a malicious serialized payload and transmit it via HTTP requests to vulnerable Cityworks endpoints. When the .NET-based backend running on Microsoft IIS processes this payload, it triggers the execution of embedded malicious code. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.
3. Infrastructure & Business Impact
Successful exploitation grants the attacker remote code execution (RCE) capabilities on the hosting IIS web server. This can lead to full system compromise, lateral movement within the enterprise network, unauthorized access to critical municipal asset data, and potential ransomware deployment.
Official Vendor Advisories & References
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
Frequently Asked SecOps Questions (CVE-2025-0994)
FAQQ1. How critical is CVE-2025-0994 and is it actively exploited in the wild?
CVE-2025-0994 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 31.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-0994?
Primary impacted vendors include trimble, microsoft across cityworks, iis. Scope summary: Trimble Cityworks versions prior to 15.8.9, and Cityworks with Office Companion versions prior to 23.10 running on Microsoft IIS
Q3. What temporary mitigations or workarounds exist for CVE-2025-0994 before patching?
[Mitigation] Immediately upgrade to patched versions (Cityworks 15.8.9+ or Office Companion 23.10+) and restrict IIS access controls Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-0994
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (trimble)
View Category →Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-45659, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft Office SharePoint Missing Authentication Privilege Escalation Vulnerability (CVE-2026-56164) Security Advisory
[Affected Scope] Microsoft Office SharePoint Server environments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.