CybersecurityVulnerability Management

CISA Alerts on Ongoing Exploitation of Trimble Cityworks Vulnerability Resulting in IIS RCE

Analyst 207|
CISA Alerts on Ongoing Exploitation of Trimble Cityworks Vulnerability Resulting in IIS RCE

Active Exploitation of Trimble Cityworks Vulnerability

CISA Alerts on Ongoing Exploitation of Trimble Cityworks Vulnerability Resulting in IIS RCE

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding the ongoing exploitation of a critical vulnerability in Trimble Cityworks, a GIS-centric asset management software. This vulnerability, identified as CVE-2025-0994, poses significant risks to organizations utilizing this software.

Overview of the Vulnerability

CVE-2025-0994 is classified as a deserialization of untrusted data vulnerability, which allows attackers to execute remote code on affected systems. The vulnerability has been assigned a CVSS v4 score of 8.6, indicating a high level of severity.

Key Points

  • Vulnerability Identifier: CVE-2025-0994
  • CVSS v4 Score: 8.6 (High)
  • Type: Deserialization of untrusted data
  • Impact: Remote Code Execution (RCE)
  • Active Exploitation: Confirmed in the wild

Recommendations

Organizations using Trimble Cityworks are urged to take immediate action to mitigate the risks associated with this vulnerability. Recommended steps include:

  • Applying any available patches or updates from Trimble.
  • Implementing network segmentation to limit exposure.
  • Monitoring systems for unusual activity that may indicate exploitation attempts.

Conclusion

The active exploitation of CVE-2025-0994 highlights the importance of maintaining up-to-date software and implementing robust security measures. Organizations should prioritize addressing this vulnerability to protect their systems and data from potential attacks.

CisaCyber SecurityRemote Code ExecutionVulnerability
Related Intelligence

Continue Reading

Laptop on a minimalist desk with a potted plant and stack of paper in soft natural light.

WordPress Discloses Core Flaw Enabling Unauthenticated Code Execution

WordPress has patched a critical flaw that allowed hackers to execute code remotely without authentication, releasing versions 6.9.5 and 7.0.2 to fix the vulnerability. The update addresses a REST API batch-route confusion and SQL injection issue that could be triggered by a simple HTTP request.

Analyst 207
Rows of computer servers and networking equipment in a dimly lit data center with one server highlighted.

OpenSSL Flaw Exposes Servers to Memory Exhaustion Attacks

A newly discovered OpenSSL flaw, dubbed HollowByte, leaves unpatched servers vulnerable to memory exhaustion attacks, where a mere 11 bytes can trigger the allocation of up to 131 KB of memory for a message that never arrives. This tiny trigger can bring a server to its knees, freezing memory and blocking critical connections.

Analyst 207
Dimly lit server room with one server showing high memory usage.

OpenSSL Servers Vulnerable to Memory-Bloating DDoS Attacks

Beware: a simple 11-byte malicious input can cripple OpenSSL servers with a devastating DDoS attack, leaving them permanently bloated and vulnerable. This sneaky exploit, dubbed HollowByte, takes advantage of a weakness in OpenSSL's TLS handshake to drain server resources.

Analyst 207
Stack of vintage papers with handwritten notes and diagrams on a formal archive room table.

Turing's Voice Encryption System Uncovered in Wartime Papers

A treasure trove of wartime papers, known as the "Bayley papers," has surfaced in London, selling for nearly $500,000 and revealing groundbreaking details about Alan Turing's pioneering voice encryption system. This long-hidden collection has finally been transferred into the public sphere, offering historians and technologists a fascinating glimpse into Turing's secret work.

Analyst 207