High · published February 6, 2025
CVSS calls it high at 8.6. It is confirmed in active exploitation. It sits in the 98.3th percentile for exploit probability.
🔥 A sneaky deserialization bug in Trimble Cityworks is exposing your IIS web server to authenticated attackers! ⚡ Think of it like a restaurant where a chef can substitute ingredients without checking the recipe — if they get it wrong, the diners might end up with a dish that’s not only unappetizing but also dangerous! This vulnerability allows an authenticated user to execute arbitrary code on your server, which could lead to a total compromise of the system. Imagine an intruder manipulating server settings, accessing sensitive data, or even taking control of the entire server! This could be absolutely devastating for your organization.
Think of it like a restaurant where a chef can substitute ingredients without checking the recipe — if they get it wrong, the diners might end up with a dish that’s not only unappetizing but also dangerous! The deserialization vulnerability in Trimble Cityworks allows authenticated users to send malicious payloads that the server processes without proper validation, enabling remote code execution on the Microsoft IIS web server.
This vulnerability allows an authenticated user to execute arbitrary code on your server, which could lead to a total compromise of the system. Imagine an intruder manipulating server settings, accessing sensitive data, or even taking control of the entire server! This could be absolutely devastating for your organization. Immediate steps to take include upgrading Trimble Cityworks to version 15.8.9 or later, and ensure that Cityworks with Office Companion is updated to version 23.10 or higher. Additionally, review server access logs to identify any unauthorized activity. 🔒 You've got this! By taking these steps, you can secure your environment in no time! 🛡️