Trimble Cityworks (Update A)
view advisory published 2025-02-06
Successful exploitation of this vulnerability could allow an authenticated user to perform a remote code execution.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-0994US | high8.8OT critical | KEV | ||
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authen… | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-25-037-04 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-25-037-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (3)
- MitigationCityworks
For more information, see Trimble's notification.
https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0? - MitigationCityworks with office companion
For more information, see Trimble's notification.
https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0? - FixedCityworks
Cityworks has released the following update guidance for users:
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan