{"cveID":"CVE-2025-0994","vendorProject":"Trimble","product":"Cityworks","vulnerabilityName":"Trimble Cityworks Deserialization Vulnerability","dateAdded":"2025-02-07","shortDescription":"Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-02-28","knownRansomwareCampaignUse":"Unknown","notes":"https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?; https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0994","cwes":["CWE-502"],"year":2025,"state":"mapped","stale_reasons":[],"mappings":[{"domain":"enterprise","cve":"CVE-2025-0994","technique":"T1068","technique_name_at_mapping":"Exploitation for Privilege Escalation","mapping_type":"exploitation_technique","capability_group":"untrusted_data","comments":"A deserialization vulnerability in Trimble Cityworks versions before 15.8.9 (and Cityworks with Office Companion versions prior to 23.10) can be exploited by attackers using maliciously crafted serialized objects to the server, ending with escalated privileges permitting the execution remote code against a target's Microsoft IIS web server.","references":["https://www.recordedfuture.com/blog/trimble-cityworks-cve-2025-0994-vulnerability-analysis"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2025-0994","technique":"T1059","technique_name_at_mapping":"Command and Scripting Interpreter","mapping_type":"primary_impact","capability_group":"untrusted_data","comments":"A deserialization vulnerability in Trimble Cityworks versions before 15.8.9 (and Cityworks with Office Companion versions prior to 23.10) can be exploited by attackers to execute remote code against a target web server.","references":["https://www.recordedfuture.com/blog/trimble-cityworks-cve-2025-0994-vulnerability-analysis"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"}],"techniques":[{"id":"T1059","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Command and Scripting Interpreter","name_at_mapping":"Command and Scripting Interpreter","renamed":false,"revoked_by":null,"mapping_types":["primary_impact"],"sigma_rule_count":95,"has_detection_strategy":true},{"id":"T1068","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Exploitation for Privilege Escalation","name_at_mapping":"Exploitation for Privilege Escalation","renamed":false,"revoked_by":null,"mapping_types":["exploitation_technique"],"sigma_rule_count":31,"has_detection_strategy":true}],"mapping_types":["exploitation_technique","primary_impact"],"has_exploitation_technique":true,"mapping_attack_versions":["16.1"],"mapping_domains":["enterprise"],"sigma_coverage":"full","sigma_rules_tagged_cve":[],"added_after_mapping_snapshot":false,"_source":"kevmap","_built":"2026-08-23 05:47 UTC","_attack_version":"19.2"}