Hackers Are Exploiting Trimble Cityworks, CISA Warns

Hackers are exploiting a critical vulnerability in an infrastructure management system widely used by government agencies that enables remote code execution on Microsoft IIS web servers.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The Cybersecurity and Infrastructure Security Agency ordered federal civilian agencies to patch a critical vulnerability in Trimble’s Cityworks platform, tracked as CVE-2025-0994, by Feb. 28.

Cityworks Server Asset Management System is a “GIS-centric solution for local governments, utilities, airports and public works agencies to manage and maintain infrastructure across the full lifecycle,” according to the company’s website. Hackers are exploiting the flaw, prompting concerns over potential disruptions to essential services.

Colorado-based Trimble disclosed the vulnerability and warned users of the remote code execution exploit. The flaw stems from a deserialization vulnerability, allowing threat actors to gain unauthorized access and deploy malicious payloads.

CISA added the flaw to its Known Exploited Vulnerabilities Catalog, urging administrators to immediately install security updates and review systems for indicators of compromise.

Trimble’s investigation confirmed unauthorized attempts to breach specific Cityworks deployments. Some on-premises installations had over-privileged IIS identity permissions and misconfigured attachment directories.

The security advisory highlighted multiple IOCs, including SHA256 hashes of malicious files, staging IP addresses and Cobalt Strike command-and-control domains.

Attackers are using obfuscated JavaScript payloads and Rust-based malware loaders to maintain persistence on compromised servers.

Federal agencies and local governments using Cityworks are advised to:

• Apply the latest patches for versions 15.x (15.8.9) and 23.x (23.10), released on Jan. 28 and 29, respectively.
• Review IIS identity permissions to ensure they do not have domain or local administrative privileges.
• Restrict attachment directory access to prevent unauthorized modifications.