CVE-2022-28643 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16468.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/20/2026
CVE-2022-28643 represents a critical buffer overflow vulnerability affecting Bentley MicroStation CONNECT version 10.16.02.34, classified under CWE-121 as a "Stack-based Buffer Overflow" within the parsing mechanism of DGN files. This vulnerability arises from insufficient bounds checking during the processing of maliciously crafted DGN file content, specifically when the application attempts to write data beyond the allocated buffer boundaries. The flaw manifests when the software encounters malformed DGN structures that trigger a write past the end of an allocated buffer, creating an exploitable condition that can be leveraged by remote attackers. The vulnerability requires user interaction to be successfully exploited, as targets must either visit a malicious webpage or open a specially crafted DGN file that contains the malicious payload. This attack vector aligns with ATT&CK technique T1203 "Exploitation for Client Execution" and T1059.001 "Command and Scripting Interpreter" within the execution phase of the attack chain. The buffer overflow occurs during the DGN file parsing process, where the application fails to validate the size and structure of incoming data before attempting to store it in memory. When an attacker crafts a DGN file with oversized or malformed data structures, the application's memory management routines become compromised, potentially allowing arbitrary code execution with the privileges of the current user process. The vulnerability's impact extends beyond simple code execution, as it can be leveraged to escalate privileges or establish persistent access to affected systems, making it particularly dangerous in enterprise environments where MicroStation is commonly used for engineering and design work. This type of vulnerability is particularly concerning because it can be delivered through web-based attacks or file sharing mechanisms, making it accessible to attackers with minimal technical expertise. The attack surface is significantly expanded given that DGN files are commonly shared among engineering teams and can be inadvertently opened by unsuspecting users. The vulnerability's classification as a remote code execution flaw means that attackers can potentially compromise systems without requiring physical access or direct network connectivity to the target machine. Organizations using Bentley MicroStation should prioritize patching this vulnerability as it represents a significant risk to their operational security posture. The issue demonstrates the importance of proper input validation and memory management in software applications, particularly those handling complex file formats with extensive parsing logic. This vulnerability underscores the need for robust software security practices including code reviews, static analysis, and dynamic testing to identify and remediate similar buffer overflow conditions in industrial software applications. The exploitation of such vulnerabilities can lead to complete system compromise, data theft, or disruption of critical engineering workflows, making proactive vulnerability management essential for organizations relying on specialized CAD software platforms.