CVE-2022-28319 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16340.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/18/2026
CVE-2022-28319 represents a critical remote code execution vulnerability affecting Bentley MicroStation CONNECT version 10.16.02.034, a widely used computer-aided design software in engineering and construction sectors. This vulnerability falls under the CWE-457 category of "Use of Uninitialized Variable" and operates at the intersection of software security and industrial control systems. The flaw specifically manifests during the parsing of 3DM files, which are proprietary 3D model formats commonly used within the engineering community for sharing complex architectural and infrastructure designs.
The technical root cause of this vulnerability stems from insufficient memory initialization within the 3DM file parsing component of MicroStation. When the application processes a maliciously crafted 3DM file, the uninitialized memory regions are accessed without proper validation or sanitization, creating a predictable execution path for attackers. This memory access pattern allows for arbitrary code execution with the privileges of the currently running process, effectively providing attackers with complete control over the affected system. The vulnerability's exploitation requires user interaction through visiting a malicious webpage or opening a specially crafted file, making it particularly dangerous in targeted attack scenarios where social engineering can be employed.
The operational impact of CVE-2022-28319 extends beyond typical software vulnerabilities due to the critical role that MicroStation plays in industrial and infrastructure design environments. Organizations using this software often handle sensitive project data, proprietary designs, and critical infrastructure information, making successful exploitation potentially devastating. Attackers could leverage this vulnerability to install backdoors, exfiltrate confidential design data, or deploy additional malware within the network. The attack surface is particularly concerning given that 3DM files are commonly shared between engineering firms, contractors, and clients, creating multiple potential entry points for threat actors. This vulnerability aligns with ATT&CK technique T1203 for "Exploitation for Client Execution" and demonstrates the increasing sophistication of attacks targeting industrial design software.
Mitigation strategies for CVE-2022-28319 should prioritize immediate patching of affected systems, as Bentley has released updates addressing this specific vulnerability. Organizations should implement strict file validation policies, particularly for 3DM files received from external sources, and consider deploying network segmentation to limit potential lateral movement. Security teams should monitor for suspicious network activity related to file downloads and implement application whitelisting where possible. The vulnerability also underscores the importance of secure coding practices and memory management validation in industrial software development. Additional defensive measures include regular security assessments of engineering software environments and establishing incident response procedures specifically tailored to address attacks targeting design and simulation platforms. Organizations should also consider implementing email filtering solutions to block malicious attachments and web content that could deliver exploit payloads.