CVE-2025-0994: Trimble Cityworks Deserialization Vulnerability

CVE-2025-0994 is a deserialization vulnerability in Trimble Cityworks that can let an authenticated user achieve remote code execution on the Microsoft Internet Information Services (IIS) web server hosting the product. For organizations that rely on Cityworks for public-works or asset-management workflows, this matters because successful abuse can give an attacker code-level control of the web server and potentially the data and systems it can reach.

Details such as exact affected versions, attack prerequisites beyond authentication, and any scoring must be confirmed against the vendor advisory; treat the CISA description as the authoritative high-level summary until that confirmation is complete.

How it works

The flaw belongs to CWE-502 (Deserialization of Untrusted Data). In this class of weakness, an application accepts serialized objects from a user or other source and reconstructs them into live objects without sufficient validation. When the reconstructed object graph includes unexpected types or gadget chains, the deserialization process itself can trigger arbitrary code execution in the context of the hosting process.

According to the CISA summary, an authenticated user can abuse the Cityworks deserialization path to perform remote code execution against the customer’s IIS web server. No further exploit mechanics, payload formats, or privilege-escalation steps are provided in the public record, so defenders should assume that any authenticated session that can reach the vulnerable deserialization endpoint is potentially sufficient and should verify the precise attack surface in the vendor advisory.

Am I affected? How to find it in your systems

Trimble Cityworks is commonly deployed by municipalities and utilities as a web application running on Microsoft IIS. Inventory efforts should therefore focus on:

• Identifying all IIS servers that host Cityworks (or related Trimble modules) by examining application pools, virtual directories, and configuration files that reference Cityworks components.
• Cross-checking installed product versions and build numbers against the list of fixed releases published in the vendor advisory; do not rely on version ranges that are not explicitly stated there.
• Reviewing authentication and authorization configurations to determine which accounts or roles can reach the deserialization functionality.

For detection of possible exploitation, examine IIS and application logs for anomalous post-authentication activity: unexpected process creation under the IIS worker process identity, unusual outbound network connections originating from the web server, or deserialization-related exceptions that appear after legitimate user sessions. Correlate these signals with authentication logs to identify the accounts involved. Telemetry from endpoint detection tools that monitor .NET or IIS process behavior can also surface suspicious object deserialization or code-injection patterns, but any such indicators must be validated against the vendor’s own guidance.

How to remediate

The primary remediation is to apply the vendor-supplied update or mitigations exactly as described in the Trimble advisory for CVE-2025-0994. CISA’s required action is to apply those mitigations per vendor instructions or to discontinue use of the product if mitigations are unavailable.

After patching, re-inventory the environment to confirm every Cityworks instance has been updated. For the broader deserialization class, additional hardening steps that are generally applicable include restricting the types that may be deserialized, enforcing strict input validation on any data that will be deserialized, and running the IIS application pool under a least-privilege identity. Confirm that any such measures are compatible with the vendor’s supported configuration before implementing them in production.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Network segmentation: isolate Cityworks IIS servers from the broader enterprise network and limit inbound access to only those administrative or user populations that require it.
• Access restriction: tighten authentication requirements, enforce multi-factor authentication where possible, and reduce the number of accounts that can reach the application.
• Virtual patching or WAF rules: if a web-application firewall is in place, deploy rules that block or alert on anomalous serialized payloads or unexpected content types directed at Cityworks endpoints; validate any such rules against the vendor advisory to avoid breaking legitimate traffic.
• Feature disablement: if the advisory identifies a specific component or endpoint that can be turned off without loss of critical function, disable it.
• Heightened monitoring: increase logging verbosity for the IIS worker process and Cityworks application, and alert on process-creation or network events that deviate from baseline.

If no effective mitigations exist, CISA guidance is to discontinue use of the product until a fix is available.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to full compromise of the hosting server and subsequent data exposure or lateral movement. If you have reason to believe an authenticated attacker may have abused CVE-2025-0994, treat the incident as a potential breach: isolate affected systems, preserve logs, and follow your incident-response plan. Separately, you can run a free exposure scan of your email addresses against known breach data sets to determine whether credentials or personal information associated with your organization have already appeared in public breach corpora.