Emerging Threats

Trimble Cityworks: Latest Update A Insights

Analyst 207|
Trimble Cityworks: Latest Update A Insights

Trimble Cityworks Vulnerability CVE-2025-0994: Security Advisory

Overview

Trimble has recently identified a critical vulnerability, designated as CVE-2025-0994, affecting its Cityworks Server AMS (Asset Management System). This deserialization vulnerability poses a significant risk, as it could allow external actors to execute remote code on a customer’s Microsoft Internet Information Services (IIS) web server. In response, Trimble has issued security updates and an advisory to mitigate the risks associated with this vulnerability.

Key Points

  • CISA is collaborating with private industry partners to address the exploitation of CVE-2025-0994.
  • The vulnerability has been added to CISA’s Known Exploited Vulnerabilities Catalog due to evidence of active exploitation.
  • Trimble has released an advisory detailing the vulnerability and providing indicators of compromise (IOCs).
  • Users and administrators are strongly encouraged to search for IOCs and apply necessary updates and workarounds.
  • The Symantec Threat Hunter team has contributed to the guidance provided in the advisory.

IT Relevance

The discovery of CVE-2025-0994 highlights critical implications for security across various IT domains, including cloud services, networking, and compliance. Organizations utilizing Trimble Cityworks must prioritize the application of security updates to safeguard their systems against potential remote code execution attacks. This incident underscores the importance of proactive vulnerability management and the need for continuous monitoring for indicators of compromise. Furthermore, it emphasizes the necessity for organizations to stay informed about emerging threats and collaborate with industry partners to enhance their security posture.

Cyber SecurityRemote Code ExecutionVulnerability
Related Intelligence

Continue Reading

A laptop sits open on a low table in a modern corporate office lobby.

Microsoft Warns of ACR Stealer Malware Surge Targeting Enterprise Customers

Microsoft warns of a surge in ACR Stealer malware attacks targeting enterprise customers, using clever social-engineering tactics and legitimate Windows tools to steal sensitive info. The malware, described as a malicious-as-a-service operation, has seen a significant spike in attacks between late April and mid-June.

Analyst 207
Medical device in a Cancer Diagnostics lab with a computer workstation in the background.

Abbott Labs Probes Two Cyber Incidents Amid Extortion Claims

Abbott Laboratories is investigating a cyber incident that involved unauthorized access to a limited number of internal systems within its Cancer Diagnostics business, and has activated incident response procedures to address the issue. The company confirms that its operations remain unaffected and that the affected systems are separate from its other businesses and systems.

Analyst 207
Cluttered developer workstation with laptop, coding tools, and subtle blockchain diagram in background.

Malicious Vite npm Packages Exploit Blockchain C2 for RAT Delivery

Security researchers have uncovered a sneaky campaign, dubbed ViteVenom, involving seven malicious npm packages that target Vite developers, executing malicious code as soon as they're imported. These packages, published in a matter of days, may have modest download counts, but their stealthy nature raises major red flags for the supply-chain community.

Analyst 207
Security analysts examine a laptop screen in a brightly-lit security operations center with rows of computer servers in the…

GoldenEyeDog Exploits DigiCert Breach for Code-Signing Certificates

In a chilling example of malware mastery, the GoldenEyeDog group exploited a DigiCert breach to snag code-signing certificates, which they then used to cloak their malicious software in a veneer of legitimacy. This brazen heist highlights the group's cunning and capabilities, which have been under scrutiny since at least 2015.

Analyst 207