CVE-2021-46567 in MicroStation CONNECT
Summary
by MITRE • 02/18/2022
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15028.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
This vulnerability represents a critical remote code execution flaw in Bentley MicroStation CONNECT version 10.16.0.80 that demonstrates poor input validation practices during JT file processing. The vulnerability falls under the category of improper input validation as defined by CWE-20, where the software fails to properly validate the existence of objects before attempting operations on them. The issue specifically manifests within the JT file parser, which is a common format used for 3D CAD data exchange in the engineering and construction industries. When processing maliciously crafted JT files, the application does not perform adequate null pointer checks or object validation before executing operations, creating an exploitable condition that can be leveraged remotely.
The operational impact of this vulnerability extends beyond simple code execution, as it allows attackers to operate within the context of the current process with the privileges of the affected user. This means that successful exploitation could lead to complete system compromise depending on the user's permissions and the underlying operating system configuration. The requirement for user interaction through visiting a malicious webpage or opening a malicious file aligns with ATT&CK technique T1203, which describes social engineering approaches where users are tricked into performing actions that result in security breaches. Attackers could potentially deliver malicious JT files through various vectors including compromised websites, email attachments, or file sharing platforms commonly used in professional engineering environments where such files are regularly exchanged.
The technical nature of this vulnerability demonstrates a classic null pointer dereference scenario that has been extensively documented in cybersecurity literature as a primary attack surface for remote code execution exploits. The flaw essentially allows an attacker to manipulate the application's memory state through controlled input data, potentially leading to arbitrary code execution on the target system. Organizations using Bentley MicroStation CONNECT are particularly vulnerable since this software is widely deployed in critical infrastructure sectors including architecture, engineering, and construction where the software handles sensitive project data. The vulnerability's classification as ZDI-CAN-15028 indicates it was properly identified and reported through established vulnerability disclosure channels, highlighting the importance of timely patch management for commercial CAD software used in enterprise environments.
Mitigation strategies should focus on immediate patch application from Bentley Systems, which would address the underlying validation issues in the JT file parser. Network administrators should consider implementing application whitelisting policies that restrict execution of JT files from untrusted sources while also monitoring network traffic for suspicious file transfers. Security teams should conduct comprehensive vulnerability assessments to identify all instances of affected software versions within their environment and establish incident response procedures specific to this type of exploit. Additionally, user education programs should emphasize the importance of verifying file sources before opening potentially malicious content, particularly in professional settings where such files are routinely shared among team members. The vulnerability serves as a reminder of the critical need for robust input validation practices in commercial software applications that process external data formats, especially those used in high-stakes engineering and construction environments where system integrity is paramount.