Trimble Cityworks Deserialization Vulnerability Allowing Remote Code Execution

A deserialization vulnerability has been identified in Trimble Cityworks versions prior to 15.8.9, as well as in Cityworks with Office Companion versions prior to 23.10. This vulnerability could enable an authenticated user to execute remote code on a customer's Microsoft Internet Information Services (IIS) web server.

Impact

Exploitation of this vulnerability could allow an authenticated user to execute remote code on the affected server.

Remediation

Users are advised to update to Trimble Cityworks version 15.8.9 or later, or to Cityworks 23.10. On-premise users should install the updated version immediately. Cityworks Online (CWOL) deployments will receive the update automatically. Additionally, users should review their Internet Information Services (IIS) identity permissions and attachment directory configurations to ensure they are set correctly.