Alerts: CISA Adds One Known Exploited Vulnerability to Catalog

Feb 7, 2025

—

Source URL: https://www.cisa.gov/news-events/alerts/2025/02/07/cisa-adds-one-known-exploited-vulnerability-catalog
Source: Alerts
Title: CISA Adds One Known Exploited Vulnerability to Catalog

Feedly Summary: CISA has added one vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

CVE-2025-0994 Trimble Cityworks Deserialization Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

AI Summary and Description: Yes

Summary: The text discusses the addition of a new vulnerability (CVE-2025-0994) related to Trimble Cityworks to CISA’s Known Exploited Vulnerabilities Catalog, highlighting the importance of timely remediation in the context of federal cybersecurity and the need for all organizations to prioritize this practice to mitigate risks.

Detailed Description:
The text emphasizes the cybersecurity landscape and the challenges posed by vulnerabilities that can be exploited by cyber actors, particularly within federal systems. The following points detail its significance:

– **Known Vulnerability Addition**: CISA has identified and added CVE-2025-0994, a deserialization vulnerability linked to Trimble Cityworks, to its catalog. This addition reflects ongoing monitoring and responsiveness to active threats.

– **Vulnerability as a Cyber Risk**: It highlights that such vulnerabilities are common attack vectors, thus necessitating immediate attention due to the significant risk they represent to the federal enterprise.

– **Binding Operational Directive (BOD) 22-01**: This directive outlines the framework for managing these vulnerabilities. It establishes a list of known vulnerabilities that pose a considerable risk, requiring Federal Civilian Executive Branch agencies to address them by set deadlines.

– **Broader Urgency for All Organizations**: Although BOD 22-01 targets federal agencies, CISA encourages all organizations to engage in proactive vulnerability management, emphasizing timely remediation of identified vulnerabilities to enhance overall cybersecurity posture.

– **Ongoing Updates**: The catalog serves as a living document that will be updated regularly as new vulnerabilities are discovered, stressing the dynamic nature of cybersecurity threats.

Overall, the text underscores the necessity for robust vulnerability management practices across various organizations, particularly pertaining to federal systems, in light of the increasing sophistication and prevalence of cyber threats. Security and compliance professionals should take heed of these guidelines to safeguard their networks and reduce the risk of exploitation.

01 1 2 4 5 7 a Act active exploitation active threats AGI AI alerts and art as attack attack vectors attacks based Binding Operational Directive by C catalog challenges CISA Common Vulnerabilities Common Vulnerabilities and Exposures compliance compliance professionals Context core cross CVE cyber cyber actors cyber risk cyber threat cyber threats cyberattack Cyberattacks cybersecurit Cybersecurity cybersecurity landscape cybersecurity posture cybersecurity threat cybersecurity threats D de deserialization deserialization vulnerability directive document e enterprise ERP event exp exploit Exploitation exploited vulnerabilities Exposures fact federal agencies Federal Civilian Executive Branch federal cybersecurity federal enterprise for framework g Gen Go guidelines high Highlight HR http HTTPS in information ite k Known Exploited Vulnerabilities Known Exploited Vulnerabilities Catalog known vulnerabilities l land led Link linked Living low malicious cyber actors management media Monitor monitoring network networks news no o of on one operation organization organizations out over phi point post pre proactive proactive vulnerability management professionals R rag RCE red remediation Risk risks Ro s safe sec security security and compliance security landscape security posture security threat security threats side Sig source SSE system systems T text the threat threats Time to Tor TP Trimble Cityworks two UI up update updates US V val vectors vulnerabilities vulnerabilities catalog vulnerability Vulnerability Management vulnerability management practice vulnerability management practices Wi x