CVE-2022-28311 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. Crafted data in a DXF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16341.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/17/2026
CVE-2022-28311 represents a critical buffer overread vulnerability affecting Bentley MicroStation CONNECT version 10.16.02.034, classified under CWE-125 as an "Out-of-bounds Read" flaw. This vulnerability exists within the software's DXF file parsing mechanism, where the application fails to properly validate buffer boundaries when processing maliciously crafted DXF content. The flaw allows attackers to construct specially formatted DXF files that trigger memory access violations, specifically reading data beyond the allocated buffer space. This type of vulnerability falls under the ATT&CK technique T1203 - Exploitation for Client Execution, as it requires user interaction to deliver the malicious payload through web browsing or file opening activities. The vulnerability is particularly dangerous because it operates within a widely used CAD software platform that serves engineering and architectural professionals, making it an attractive target for nation-state actors and cybercriminals seeking to compromise critical infrastructure design environments.
The technical exploitation of CVE-2022-28311 occurs when a user opens a malicious DXF file within MicroStation, triggering the buffer overread condition during file parsing operations. The software's insufficient input validation allows crafted data structures to bypass normal boundary checks, causing the application to read memory locations beyond the intended buffer limits. This memory corruption can result in arbitrary code execution with the privileges of the current user process, potentially enabling attackers to install malware, steal sensitive data, or establish persistent access to the compromised system. The vulnerability's impact extends beyond simple code execution as it can be leveraged for privilege escalation attacks, especially when the affected software runs with elevated permissions. Security researchers have noted that the flaw's exploitation requires minimal user interaction, making it particularly effective in phishing campaigns or supply chain attacks targeting engineering firms and government agencies that rely heavily on CAD software for critical projects.
Organizations utilizing Bentley MicroStation CONNECT are strongly advised to implement immediate mitigation strategies including mandatory software updates from the vendor, network segmentation to limit access to potentially malicious file types, and enhanced user education regarding suspicious file attachments. The vulnerability's classification as a remote code execution flaw necessitates comprehensive network monitoring for unusual file access patterns and suspicious web traffic. Security teams should consider implementing application whitelisting policies that restrict the execution of unauthorized DXF parsers or file conversion utilities that might be leveraged in secondary exploitation attempts. Additionally, organizations should conduct thorough vulnerability assessments of their CAD environments to identify other potentially vulnerable applications that might share similar parsing mechanisms. The ATT&CK framework's T1190 - Exploit Public-Facing Application category applies here as the vulnerability can be exploited through web-based delivery mechanisms, while T1059 - Command and Scripting Interpreter may be relevant for any post-exploitation command execution capabilities that could arise from successful exploitation of this vulnerability.