CVE-2025-0994

What it actually does

CVE-2025-0994 is an authenticated deserialization vulnerability in Trimble Cityworks before version 15.8.9 and Cityworks with Office Companion before version 23.10. A valid Cityworks user can submit crafted serialized data that the IIS-hosted application processes unsafely, causing arbitrary code execution on the Microsoft IIS web server. Successful exploitation can allow command execution in the context of the Cityworks application pool identity, file creation or modification under the web application directory, credential access, lateral movement, and deployment of persistence such as web shells or scheduled tasks.

Why it matters to the business

Because Cityworks is commonly used for public works, utilities, permitting, asset management, and operational workflows, exploitation can disrupt service delivery, expose sensitive operational data, and provide an attacker a foothold into broader municipal or enterprise networks. The vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and had a CISA remediation deadline of 2025-02-28, so unpatched systems should be treated as high-priority legacy exposure even if authentication is required. Although not specifically marked as ransomware-used in KEV, remote code execution on an IIS server can enable ransomware staging, data theft, and operational outages.

How an attack unfolds

An attacker first obtains valid Cityworks credentials through phishing, credential reuse, password spraying, purchase of stolen credentials, or compromise of a lower-privileged account. The attacker authenticates to the vulnerable Cityworks web application and sends a specially crafted request containing malicious serialized data to functionality that performs unsafe deserialization. When the IIS-hosted application deserializes the payload, attacker-controlled code or commands execute under the IIS application pool account. The attacker may then run discovery commands, write a web shell into a web-accessible directory, create persistence, dump credentials, connect outbound to command-and-control infrastructure, and move laterally into adjacent Windows systems or databases used by the Cityworks deployment.

How to fix it

Upgrade Trimble Cityworks to version 15.8.9 or later and upgrade Cityworks with Office Companion to version 23.10 or later. If immediate upgrade is not possible, restrict access to the Cityworks application to trusted networks or VPN, remove direct internet exposure, enforce MFA for all Cityworks users, disable or remove unnecessary accounts, and monitor all authenticated access closely. Review IIS application pool permissions and ensure the application pool identity has only the minimum privileges required. Rotate credentials that may be accessible from the Cityworks server, including service accounts and database credentials, after patching and after any suspected compromise. Web application firewalls or request filtering may reduce opportunistic exploitation but should not be treated as a complete fix for unsafe deserialization.

How to confirm the fix worked

Confirm the installed Trimble Cityworks version is 15.8.9 or later and Cityworks with Office Companion is 23.10 or later using vendor-supported version checks, application administration pages, installed program inventory, file metadata, and deployment records. Verify that all load-balanced nodes, standby servers, test systems, and Office Companion components were upgraded, not only the primary web server. Confirm that IIS sites serving Cityworks were restarted after patching and that old application files or backup virtual directories are not still exposed. From a network perspective, validate that Cityworks is not directly reachable from untrusted networks unless explicitly required. Review vulnerability scanner results and authenticated asset inventory for any remaining pre-15.8.9 or pre-23.10 installations.

Typical attack path

1. Identify an internet-accessible or internally reachable Trimble Cityworks IIS application.
2. Obtain valid Cityworks credentials through phishing, credential stuffing, password spraying, brokered access, or prior compromise.
3. Log in to the Cityworks application as an authenticated user.
4. Send a crafted deserialization payload to the vulnerable application functionality.
5. Achieve command execution through the IIS worker process, typically w3wp.exe, under the Cityworks application pool identity.
6. Run reconnaissance commands such as whoami, hostname, ipconfig, net, nltest, or directory listing commands.
7. Drop a web shell, loader, or remote management payload into a writable IIS or application directory.
8. Establish persistence through scheduled tasks, services, startup folders, web shell access, or new local/domain accounts.
9. Access Cityworks data, connected databases, file shares, and credentials available to the compromised server.
10. Pivot further into the Windows environment or stage data theft, disruption, or ransomware deployment.

How to detect it

Investigate whether any authenticated Cityworks requests were followed by unusual activity from the IIS worker process. Primary log sources include IIS W3C access logs, Cityworks application logs, Windows Security logs, Sysmon or EDR telemetry, PowerShell operational logs, Windows Defender or antivirus alerts, scheduled task logs, service-control-manager events, and file integrity monitoring for IIS and Cityworks directories. Look for w3wp.exe spawning command interpreters or scripting tools, creation of unexpected .aspx/.ashx files under IIS web roots or Cityworks directories, suspicious outbound network connections from the IIS server, and post-exploitation commands such as whoami, ipconfig, net user, nltest, certutil, bitsadmin, curl, or PowerShell download cradles. Correlate suspicious activity with successful Cityworks logins, especially from unusual IP addresses, new user agents, impossible travel, after-hours access, or accounts that do not normally perform administrative actions. If exploitation is suspected, preserve volatile evidence, collect memory if feasible, quarantine the host, and perform credential rotation after containment.

• ParentImage=w3wp.exe Image=cmd.exe
• ParentImage=w3wp.exe Image=powershell.exe
• ParentImage=w3wp.exe Image=pwsh.exe
• ParentImage=w3wp.exe Image=certutil.exe
• ParentImage=w3wp.exe Image=bitsadmin.exe
• ParentImage=w3wp.exe Image=curl.exe
• ParentImage=w3wp.exe Image=wget.exe
• ParentImage=w3wp.exe Image=mshta.exe
• ParentImage=w3wp.exe Image=rundll32.exe
• ParentImage=w3wp.exe Image=regsvr32.exe
• ParentImage=w3wp.exe Image=whoami.exe
• ParentImage=w3wp.exe Image=net.exe
• ParentImage=w3wp.exe Image=nltest.exe
• ParentImage=w3wp.exe Image=quser.exe
• ParentImage=w3wp.exe Image=tasklist.exe
• powershell -enc
• powershell -EncodedCommand
• IEX(New-Object Net.WebClient).DownloadString
• Invoke-WebRequest
• Start-BitsTransfer
• certutil -urlcache -split -f
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• \inetpub\wwwroot\*.aspx
• \inetpub\wwwroot\*.ashx
• \Cityworks\*.aspx
• \Cityworks\*.ashx
• \Cityworks\*.config
• Event ID 4688 w3wp.exe cmd.exe
• Event ID 4688 w3wp.exe powershell.exe
• Event ID 4104 DownloadString
• Event ID 4104 EncodedCommand
• Event ID 7045 Service Control Manager
• schtasks /create
• net user /add
• net localgroup administrators /add

What your security team should do

• Treat any unpatched internet-accessible Cityworks instance as an active compromise risk because this vulnerability is in CISA KEV and exploitation is active in the wild.
• Upgrade Cityworks to 15.8.9 or later and Cityworks with Office Companion to 23.10 or later immediately; the KEV remediation due date of 2025-02-28 has passed.
• Temporarily restrict Cityworks access to VPN or trusted administrative networks until all components are verified patched.
• Hunt for IIS worker process child-process execution, web shell creation, abnormal outbound connections, and suspicious authenticated Cityworks activity dating back at least to the public disclosure date and preferably earlier if logs are available.
• Rotate Cityworks, IIS application pool, database, and related service account credentials if exploitation is suspected or if the server was exposed while vulnerable.
• Ensure MFA and strong conditional access controls are enforced for Cityworks users, especially administrative and service accounts.
• Review IIS and application directory permissions to prevent the application pool identity from writing executable content to web-accessible paths unless required.
• Preserve IIS logs, Windows event logs, EDR telemetry, PowerShell logs, and application logs before rebuilding or cleaning any suspected compromised server.