Summary: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical security vulnerability (CVE-2025-0994) in Trimble Cityworks software that is currently being exploited. This deserialization flaw could enable remote code execution by authenticated users, affecting various versions of the platform. Users are urged to promptly apply the latest patches released by Trimble to mitigate risks from potential attacks.
Affected: Trimble Cityworks software
Keypoints :
- Vulnerability CVE-2025-0994 has a CVSS v4 score of 8.6, indicating high severity.
- The flaw affects all versions of Cityworks prior to 15.8.9 and Cityworks with office companion prior to 23.10.
- Attackers are exploiting this vulnerability to deploy malicious payloads, including a Rust-based loader and remote access tools.
- Users are advised to update to the latest software version to ensure protection against ongoing attacks.
Source: https://thehackernews.com/2025/02/cisa-warns-of-active-exploitation-in.html