Loading vulnerability…
Authenticated remote code execution in Trimble Cityworks
CVE-2025-0994 is an unsafe deserialization vulnerability affecting Trimble Cityworks versions before 15.8.9 and Cityworks with Office Companion versions before 23.10. An authenticated remote attacker can exploit the flaw to execute arbitrary code on the Microsoft Internet Information Services (IIS) web server hosting the application. Exploitation in the wild began in January 2025, with activity tracked as UAT-6382 involving reconnaissance, web shell deployment, and additional malware installation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution on the affected IIS web server. Observed intrusions involved deployment of AntSword, Chopper, and Behinder web shells, directory enumeration, and copying backup archives into web-accessible locations for staging and exfiltration. Attackers also deployed the Rust-based TetraLoader to load Cobalt Strike and VShell payloads, enabling persistent access and further post-compromise activity. Attempts to pivot toward utilities-management systems were observed, but successful compromise of those systems is not established.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to Cityworks to only trusted users and networks, remove unnecessary internet exposure, and tightly limit reachability to the IIS-hosted application. Monitor IIS logs, application logs, and filesystem locations commonly used for web shells and staging. Hunt for post-exploitation artifacts described in public reporting, including suspicious PowerShell activity, anomalous child processes from IIS worker processes, unexpected files in %TEMP% and upload directories, and outbound connections to attacker-controlled infrastructure. Enforce least privilege for Cityworks accounts and isolate the hosting server from sensitive internal systems where possible.
Patch, then assume compromise.
Upgrade Trimble Cityworks to version 15.8.9 or later, or Cityworks with Office Companion to version 23.10 or later, as applicable.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.