CVE-2022-28642 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16424.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/20/2026
This vulnerability represents a critical buffer overflow flaw in Bentley MicroStation CONNECT version 10.16.02.34 that enables remote code execution through malicious DGN file manipulation. The vulnerability stems from insufficient input validation during the parsing of DGN (Digital Geographic Network) files, which are standard formats used for storing 2D and 3D geometric data in engineering and architectural applications. The flaw specifically manifests when the software processes crafted data within DGN files, leading to a write past the end of an allocated buffer. This type of vulnerability falls under CWE-121, which categorizes buffer overflow conditions where data is written beyond the boundaries of a fixed-length buffer. The security implications are severe as this allows attackers to execute arbitrary code with the privileges of the current user process, potentially leading to complete system compromise.
The exploitation scenario requires user interaction, making this a targeted attack vector that typically involves social engineering tactics. An attacker would need to entice a victim to open a maliciously crafted DGN file, either through phishing emails, malicious websites, or compromised file sharing platforms. This user interaction requirement aligns with ATT&CK technique T1204.002, which describes user execution through maliciously crafted files. The vulnerability's remote exploitation capability means that attackers can deliver malicious payloads without requiring physical access to the target system, making it particularly dangerous in enterprise environments where users frequently exchange design files. The buffer overflow occurs during the parsing phase, indicating that the software's memory management routines fail to properly validate the size of incoming data before attempting to write it into allocated memory regions.
The operational impact of this vulnerability extends beyond simple code execution to potentially compromise entire engineering workflows and data integrity. Bentley MicroStation is widely used in critical infrastructure projects, architectural design, and engineering applications where the integrity of design data is paramount. If successfully exploited, an attacker could gain access to sensitive project data, modify design files, or establish persistent backdoors within the organization's design environment. The vulnerability affects not just individual workstations but could potentially impact entire networks of users who regularly exchange DGN files. Organizations using this software face significant risk as the exploitation could lead to intellectual property theft, disruption of engineering processes, and potential safety hazards in critical infrastructure projects where design accuracy is crucial.
Mitigation strategies for this vulnerability should include immediate patch deployment from Bentley, as this represents a known security issue that has been documented and addressed by the vendor. System administrators should implement strict file validation policies and consider deploying sandboxing solutions for DGN file handling to isolate potential exploitation attempts. Network-based mitigations could include filtering DGN files at network boundaries and implementing application whitelisting to prevent unauthorized software execution. The vulnerability also highlights the importance of user security awareness training to prevent social engineering attacks that might deliver malicious DGN files. Organizations should conduct comprehensive vulnerability assessments to identify all systems running affected versions of MicroStation and establish incident response procedures for potential exploitation attempts. Additionally, regular security updates and patch management processes should be strengthened to ensure timely remediation of similar vulnerabilities in the future, as this type of memory corruption vulnerability frequently appears in complex engineering software applications.