- Trimble warns CityWorks abused in RCE attack
- The company released a patch to solve the problem
- CISA warns users to apply patch as soon as possible
Hackers hijack government software To access sensitive servers, experts have warned.
The warning comes from software vendor Trimble, whose product appears to have been used in the attack. In a letter sent to his clients and partners, Trimble said that the observed cyber criminals who abused a essialization vulnerability in its CityWorks product to participate in Remote Code Execution (RCE) and implement Cobalt Strike Beacons on Microsoft Internet Information Services (IIS) -servers.
Trimble CityWorks is a geographical information system) It turned out to have been vulnerable to the CVE-2025-0994, a high-severity of the High Deficizing Error that enables RCE, considering a severity of 8.6 (high).
Patching of the error
“After our research on reports on unauthorized attempts to access specific customers’ CityWorks implementations, we have three updates to give you,” the company said in the letter. To tackle the threat, Trimble CityWorks updated 15.X to version 15.8.9 and 23.x to 23.10. It also warned about discovering some on-prema implementations that had overprivileged IIS identity permits, adding that some implementations have wrong wrong catalog configurations.
All of these must be addressed at the same time to mitigate the threat and resume normal operations with CityWorks.
We don’t know how big attacks have found. “CISA is reminiscent of organizations to perform proper impact assessment and risk assessment before they are inserted defensive measures,” it was said in the counseling.
“Organizations observing suspicion of malicious activity should follow established internal procedures and report findings to CISA for tracking and coherence against other events.”
Via Bleeping computer
