Week of February 3, 2025: Atlassian Names New CISO, CISA Flags Trimble Cityworks Exploit

Security leaders watched Atlassian name David Cross as its new chief information security officer even as CISA added an actively exploited Trimble Cityworks flaw to its Known Exploited Vulnerabilities Catalog and issued three more KEV updates covering Microsoft Outlook, Apache OFBiz, and the Linux kernel. CISA also released six Industrial Control Systems advisories and joined Australian, Canadian, and UK cyber agencies in publishing new guidance on securing network edge devices.

Atlassian Appoints David Cross as Chief Information Security Officer

Atlassian appointed David Cross as its new chief information security officer, moving from his prior post as senior vice president and CISO at Oracle after earlier security leadership roles at Google and Microsoft. The appointment was reported in SecurityWeek's People on the Move roundup for the week of February 3, 2025, alongside other cybersecurity leadership moves at Brinqa, Gigamon, Mitiga and Cynet. Cross takes on security leadership for the widely used collaboration and developer tools maker as organizations continue scrutinizing software supply chain risk and executive security accountability. (SecurityWeek)

CISA Adds Trimble Cityworks Flaw to Known Exploited Vulnerabilities Catalog

CISA added CVE-2025-0994, a deserialization vulnerability in Trimble Cityworks Server AMS, to its Known Exploited Vulnerabilities Catalog on February 7, 2025, based on evidence of active exploitation. The listing obligated Federal Civilian Executive Branch agencies operating under Binding Operational Directive 22-01 to remediate the flaw by its assigned due date. CISA urged all organizations, not only federal agencies, to prioritize patching Catalog vulnerabilities as part of routine vulnerability management, citing the frequency with which such flaws serve as attack vectors for malicious cyber actors. (CISA)

Trimble Issues Patches for Exploited Cityworks Deserialization Bug

Trimble released security updates and an advisory addressing the Cityworks deserialization flaw after reports surfaced of exploitation against customer deployments of its Cityworks Server AMS asset management software. CISA said the vulnerability could let an external actor conduct remote code execution against a victim's Microsoft Internet Information Services web server. The agency worked with private industry, including Broadcom's Symantec Threat Hunter team, to publish indicators of compromise and urged users and administrators to search their environments for signs of compromise and apply the available patches and workarounds. (CISA)

CISA Catalogs Five More Exploited Flaws, Including Microsoft Outlook Bug

CISA added five more vulnerabilities to its Known Exploited Vulnerabilities Catalog on February 6, 2025, including a Microsoft Outlook improper input validation flaw tracked as CVE-2024-21413, a 7-Zip Mark of the Web bypass, a Dante Discovery process control bug, and SQL injection and buffer overflow flaws affecting Sophos CyberoamOS and the Sophos XG Firewall. CISA said evidence showed each vulnerability was being actively exploited and reiterated that Federal Civilian Executive Branch agencies must remediate catalog entries by their assigned due dates under Binding Operational Directive 22-01. (CISA)

CISA Adds Apache OFBiz, .NET and PRTG Flaws to KEV Catalog

On February 4, 2025, CISA added four vulnerabilities to the Known Exploited Vulnerabilities Catalog, citing active exploitation of an Apache OFBiz forced browsing flaw, a Microsoft .NET Framework information disclosure bug, and two older Paessler PRTG Network Monitor vulnerabilities covering OS command injection and local file inclusion. The addition reinforced CISA's recurring message that known, patchable vulnerabilities remain frequent entry points for attackers, with Federal Civilian Executive Branch agencies required to apply fixes within the directive's remediation timeline. (CISA)

Actively Exploited Linux Kernel Flaw Lands on KEV Catalog

CISA added a Linux Kernel out-of-bounds write vulnerability, CVE-2024-53104, to its Known Exploited Vulnerabilities Catalog on February 5, 2025, after confirming evidence of active exploitation. The single addition kept pressure on federal civilian agencies to track and patch kernel-level flaws alongside the growing list of actively exploited bugs disclosed that week, part of CISA's ongoing effort under Binding Operational Directive 22-01 to shrink the window attackers have to exploit known, unpatched software weaknesses across government networks. (CISA)

CISA Publishes Six ICS Advisories Spanning Schneider Electric, ABB and Medical Imaging Software

CISA released six Industrial Control Systems advisories on February 6, 2025, covering Schneider Electric's EcoStruxure Power Monitoring Expert and EcoStruxure products, ABB's Drive Composer, Trimble Cityworks, and medical imaging software from MicroDicom and Orthanc Server. The advisories detailed current vulnerabilities and exploits affecting ICS environments and urged users and administrators to review the technical specifics and apply recommended mitigations, reflecting the ongoing stream of operational-technology risk disclosures CISA issues to critical infrastructure operators and asset owners. (CISA)

CISA Joins Australia, Canada and UK on Edge Device Security Guidance

CISA joined Australia's ACSC, Canada's CCCS and the UK's NCSC, along with other international and U.S. partners, to publish guidance on securing network edge devices such as firewalls, routers, VPN gateways and internet-facing operational technology systems, released February 4, 2025. The documents included CCCS-led security considerations for edge devices, NCSC-UK-led digital forensics monitoring specifications, and two ASD's ACSC mitigation guides for executives and practitioners. The agencies warned that foreign adversaries routinely exploit edge device vulnerabilities to infiltrate critical infrastructure networks. (CISA)