CVE-2025-0994

KEV
Published: Feb 06, 2025 Last Modified: Ott 30, 2025
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,7780
Percentile
1,0th
Updated

EPSS Score Trend (Last 90 Days)

502

Deserialization of Untrusted Data

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Application Data Unexpected State Dos: Resource Consumption (Cpu) Varies By Context
Applicable Platforms
Languages: Java, JavaScript, PHP, Python, Ruby
Technologies: AI/ML, ICS/OT, Not Technology-Specific
Likelihood of Exploit: Medium
View CWE Details
Application

Cityworks by Trimble

Product Information
Vendor Trimble
Product Cityworks
Version Range Affected
To 15.8.9 (exclusive)
cpe:2.3:a:trimble:cityworks:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Cityworks by Trimble

Product Information
Vendor Trimble
Product Cityworks
Version Range Affected
From 23.0 (inclusive)
To 23.10 (exclusive)
cpe:2.3:a:trimble:cityworks:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalo…
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025…
https://learn.assetlifecycle.trimble.com/i/1532182-citywork…
https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communica…
https://www.cisa.gov/news-events/ics-advisories/icsa-25-037…
https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04