CVE-2025-0994

ENISA EUVD: EUVD-2025-1955 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 5, 2026 3 articles Published: 2025-02-06
VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23
75.22%
probability
This CVE has a 75.22% probability of being exploited in the next 30 days.
0% Top 98.9th percentile of all CVEs 100%

CVSS v4.0 NEW

Source: VulnerabilityLookup (CIRCL)
8.6
HIGH
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
High
User Interaction
None
Vulnerable System Confidentiality Impact
High
Vulnerable System Integrity Impact
High
Vulnerable System Availability Impact
High
Subsequent System Confidentiality Impact
None
Subsequent System Integrity Impact
None
Subsequent System Availability Impact
None
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1

Source: NVD
8.8
HIGH
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

VulnerabilityLookup (CNA)
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.

Affected Products

Trimble
Cityworks
0
Trimble
Cityworks (with office companion)
0

Attack Intelligence

Exploits & PoC

rxerium/CVE-2025-0994

Cityworks deserialization of untrusted data vulnerability Detection

4 2025-10-14
1 repo — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidenceⓘ
85%
EPSS 75.22%
CVSS v4.0 8.6
CVSS v3.1 8.8
Mentions 3
Last Seen May 22, 2025

CNA Information

CNA Assigner
icscert

Analyst Note

CVE-2025-0994 is a February 2025 vulnerability with active exploitation by Chinese threat actors against US local governments reported by BleepingComputer. The article explicitly labels it as a 'zero-day', and the timing (CVE published Feb 6, 2025; exploitation actively occurring) indicates real-world attacks preceded or coincided with patch availability. High CVSS score and authenticated RCE capability support severity claims.

Threat Actors 22

Lazarus Group
apt_group Information theft and espionage 🇰🇵 KP
Mustang Panda
apt_group Information theft and espionage 🇨🇳 CN
Cobalt
apt_group Financial crime 🇷🇺 RU
APT 28
apt_group Information theft and espionage 🇷🇺 RU
CHRYSENE
apt_group Information theft and espionage 🇮🇷 IR
Vicious Panda
apt_group Information theft and espionage 🇨🇳 CN
Hacking Team
apt_group 🇮🇹 IT
Cleaver
apt_group Information theft and espionage 🇮🇷 IR
Volt Typhoon
apt_group Information theft and espionage 🇨🇳 CN
YoroTrooper
apt_group Information theft and espionage 🇰🇿 KZ
[Unnamed group]
apt_group 🇨🇳 CN
Silent Lynx
apt_group Information theft and espionage 🇰🇿 KZ
APT 22
apt_group Information theft and espionage 🇨🇳 CN
APT 6
apt_group Information theft and espionage 🇨🇳 CN
Pat Bear
apt_group 🇸🇾 SY
Operation Digital Eye
apt_group Information theft and espionage 🇨🇳 CN
Unnamed Actor
apt_group 🇨🇳 CN
Shadow Network
apt_group Information theft and espionage 🇨🇳 CN
Mana Team
apt_group 🇨🇳 CN
Operation Shadow Force
apt_group 🇨🇳 CN
Natohub
apt_group 🇪🇸 ES
APT 5
apt_group Information theft and espionage 🇨🇳 CN

Triage Info

Decided atMar 05, 2026
Published DateFeb 06, 2025