{"id":3861,"date":"2025-02-07T13:39:04","date_gmt":"2025-02-07T13:39:04","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/cisa-warns-of-active-exploits-for-trimble-cityworks-vulnerability\/"},"modified":"2025-02-07T13:39:05","modified_gmt":"2025-02-07T13:39:05","slug":"cisa-warns-of-active-exploits-for-trimble-cityworks-vulnerability","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/cisa-warns-of-active-exploits-for-trimble-cityworks-vulnerability\/","title":{"rendered":"CISA Warns of Active Exploits for Trimble Cityworks Vulnerability"},"content":{"rendered":"\n<\/p>\n<p><strong>Trimble Cityworks Vulnerability: A Deserialization of Untrusted Data Bug<\/strong><\/p>\n<p><strong>February 7, 2025<\/strong><\/p>\n<p><strong>The Hacker News<\/strong><\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhZsyQSd6bFNivpG4VIPqsnw73g1X5HP06a7hN1d47EJuDgyVZiylW-CUJ-yhgjEMSZzBebWh3HC4NlXusIzG7eekqwhjmYVdcrYMasXYYKphVqtSZSF0TSIEgaEeu_ikV0YLc38vYMy6BPnDDWgGwByQvhvJHIR2C7SAmB9AFivt78NLozVdjqbdx80ZM\/s728-rw-e365\/cityworks-exploit.png\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><\/a><\/div>\n<p><strong>U.S. Cybersecurity and Infrastructure Security Agency (CISA) Warns of Active Exploitation<\/strong><\/p>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that a security flaw in Trimble&#8217;s Cityworks GIS-centric asset management software is being actively exploited in the wild. The vulnerability, identified as CVE-2025-0994 (CVSS v4 score: 8.6), is a deserialization of untrusted data bug that could permit an attacker to conduct remote code execution.<\/p>\n<p><strong>Impact and Affected Versions<\/strong><\/p>\n<p>CISA has stated that this vulnerability could allow an authenticated user to perform a remote code execution attack against a customer&#8217;s Microsoft Internet Information Services (IIS) web server. The affected versions of Cityworks include:<\/p>\n<ul>\n<li>All versions prior to 15.8.9<\/li>\n<li>Cityworks with office companion (All versions prior to 23.10)<\/li>\n<\/ul>\n<p><strong>Patches and Recommendations<\/strong><\/p>\n<p>Trimble has released patches to address the security defect as of January 29, 2025. CISA has warned that the vulnerability is being weaponized in real-world attacks, and users running affected versions of the software are advised to update their instances to the latest version for optimal protection.<\/p>\n<p><strong>Indicators of Compromise (IoCs)<\/strong><\/p>\n<p>Trimble has released indicators of compromise (IoCs) that show the vulnerability is being exploited to drop a Rust-based loader that launches Cobalt Strike and a Go-based remote access tool named VShell, among other unidentified payloads.<\/p>\n<p><strong>Current Status and Next Steps<\/strong><\/p>\n<p>It is currently not known who is behind the attacks, and what the end goal of the campaign is. Users running affected versions of the software are advised to update their instances to the latest version for optimal protection.<\/p>\n<p><strong>Stay Informed<\/strong><\/p>\n<p>Follow us on Twitter and LinkedIn to read more exclusive content we post.<\/p>\n<p><strong>About The Hacker News<\/strong><\/p>\n<p>This article is a contributed piece from one of our valued partners.<\/p>\n\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/02\/cisa-warns-of-active-exploitation-in.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Trimble Cityworks Vulnerability: A Deserialization of Untrusted Data Bug February 7, 2025 The Hacker News U.S. Cybersecurity and Infrastructure Security Agency (CISA) Warns of Active Exploitation The U.S. Cybersecurity and&#8230;<\/p>\n","protected":false},"author":19,"featured_media":3862,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-3861","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/02\/cityworks-exploit.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/3861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=3861"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/3861\/revisions"}],"predecessor-version":[{"id":3863,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/3861\/revisions\/3863"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/3862"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=3861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=3861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=3861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}