Exploited Vulnerabilities DailyCVE-2025-0994: Trimble Cityworks
EPSS31.0%No. 999 of 1739 in KEV
CVE year2025listed the same year
Same vendor in KEV1
Same product1
| Field | Value |
|---|---|
| Vendor | Trimble |
| Product | Cityworks |
| Name | Trimble Cityworks Deserialization Vulnerability |
| Added to KEV | 2025-02-07 |
| US federal due date | 2025-02-28 |
| Ransomware use | Unknown |
| CWE | CWE-502 |
CISA description
Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A Trimble Cityworks vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2025-02-07.