Which versions of Cityworks are affected by CVE-2025-0994?

CVE-2025-0994 presents significant security risk, a insecure deserialization vulnerability rated CVSS 8.6.

Is CVE-2025-0994 being actively exploited?

Yes, CVE-2025-0994 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2025-0994?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Cityworks CVE-2025-0994

Q: What is the CVSS score of CVE-2025-0994?

CVE-2025-0994 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 76.0%.

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-02-06 ics-cert@hq.dhs.gov

Microsoft RCE Deserialization Cityworks

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:25 vuln.today

Added to CISA KEV

Oct 30, 2025 - 15:54 cisa

CISA KEV

CVE Published

Feb 06, 2025 - 16:15 nvd

HIGH 8.6

DescriptionCVE.org

Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.

AnalysisAI

Trimble Cityworks asset management platform contains a deserialization vulnerability allowing authenticated users to achieve remote code execution on the IIS web server hosting the application.

Technical ContextAI

The CWE-502 deserialization flaw processes untrusted serialized data from authenticated users. The .NET deserialization executes in the context of the IIS application pool, allowing OS command execution on the web server.

RemediationAI

Update Cityworks. Implement .NET serialization filtering. Restrict application access to authorized users. Monitor IIS for suspicious process execution.