Trimble Cityworks: CVE-2025-0994

Recorded Future’s Insikt Group details CVE-2025-0994, a high-severity deserialization vulnerability in Trimble Cityworks that allows authenticated remote code execution against IIS. The report notes active exploitation delivering Rust-based loaders, VShell and Cobalt Strike, provides IoCs (including C2 IPs), cites 111 exposed Cityworks instances with a portion vulnerable, and recommends immediate patching to versions 15.8.9/23.10 or later with reference to CISA guidance.