Historical catalog analysis: CISA added this entry on February 07, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-0994 is a deserialization vulnerability (CWE-502) identified in Trimble Cityworks. If exploited, this flaw could allow an authenticated user to perform remote code execution (RCE) against the customer’s Microsoft Internet Information Services (IIS) web server hosting the application.
Exposure and applicability
This vulnerability is applicable to organizations utilizing Trimble Cityworks for the management of municipal or industrial assets. Because Cityworks often serves as a central repository for infrastructure data, an RCE event on the IIS server could potentially grant an attacker access to sensitive asset inventories and operational documentation.
Exploitation requires the attacker to possess authenticated user access to the system. It is not reported as being exploitable by unauthenticated external actors. While CISA has added this to its Known Exploited Vulnerabilities catalog, the status of use in known ransomware campaigns remains unknown.
Remediation priorities
Based on our analysis, asset owners should prioritize the following actions:
- Vendor Mitigation Application: The primary priority is to apply mitigations according to Trimble’s official instructions. If mitigations are unavailable for a specific deployment, the vendor suggests discontinuing use of the product.
- Access Review: Since exploitation requires authentication, OT security leaders should review user permissions within Cityworks. Reducing the number of users with active accounts and ensuring the principle of least privilege is applied could reduce the likelihood of an internal or compromised account being used to trigger the vulnerability.
- Network Segmentation: Ensuring that the IIS server hosting Cityworks is segmented from critical process control networks (e.g., PLCs, HMIs) can limit the potential for lateral movement should the web server be compromised via RCE.
How to validate remediation
Validation should be conducted through a combination of version verification and configuration audits. Administrators should confirm that the specific mitigations provided by Trimble have been applied to the IIS environment.
Because this is an authenticated vulnerability, validation may also include auditing the current user list to ensure only necessary personnel have access. We do not recommend active scanning or intrusive penetration testing against production asset management servers without a documented change control process and OEM guidance.
Limits and open questions
It remains unclear which specific versions of Trimble Cityworks are affected, as version numbers were not provided in the source data. Additionally, while CISA has set a remediation deadline of February 28, 2025, this date specifically applies to covered federal agencies and is not a mandatory deadline for private industrial operators, though it serves as a benchmark for urgency.
Source and editorial note
CVE-2025-0994: Trimble Cityworks Deserialization Vulnerability · Source date: February 07, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: February 10, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 21, 2026 at 01:41 UTC.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗