Executive Risk Summary
"Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability, allowing an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server. This vulnerability poses a significant risk to the security and integrity of the affected systems, and immediate attention is required to mitigate the threat."
Operational Audit Arsenal
# 🛠️ Senior Engineer Universal Audit
# Target: Microsoft Internet Information Services (IIS) (Web Server)
$Target = "Microsoft Internet Information Services (IIS)"
$SearchPaths = @("$env:windir\System32", "$env:ProgramFiles", "${env:ProgramFiles(x86)}")
Get-ChildItem -Path $SearchPaths -Filter $Target -Recurse -ErrorAction SilentlyContinue |
Select-Object FullName, @{Name="Version";Expression={$_.VersionInfo.ProductVersion}}Patch Impact Forecast
Potential Disruption to Web Services
Internal Work Notes
Intelligence Sources
Scope of Impact
Original NVD Description
"Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server."