The insecure deserialization and authorization bypass flaws could enable attackers to escalate privileges and run arbitrary commands.

Trimble Cityworks is affected by a zero-day vulnerability that has been exploited in attacks involving the delivery of malware.