CVE-2022-28644 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16469.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/20/2026
CVE-2022-28644 represents a critical buffer overflow vulnerability affecting Bentley MicroStation CONNECT version 10.16.02.34 that enables remote code execution through malicious DGN file manipulation. This vulnerability resides within the DGN file parsing component of the software, specifically when processing crafted data within DGN files that contain malformed buffer boundaries. The flaw manifests as a write past the end of an allocated buffer, a classic software security weakness that occurs when a program writes data beyond the boundaries of a pre-allocated memory block. This type of vulnerability falls under CWE-121, which describes stack-based buffer overflow conditions, and is particularly dangerous because it can be exploited to overwrite adjacent memory locations including return addresses and function pointers. The attack vector requires user interaction, meaning that victims must either visit a malicious webpage or open a specially crafted DGN file that contains the malicious payload, making this a targeted social engineering attack rather than a fully automated exploit.
The operational impact of this vulnerability extends beyond simple code execution to potentially enable complete system compromise when attackers leverage this flaw in conjunction with other exploitation techniques. The vulnerability operates at the application level where the target application parses DGN files, which are commonly used in engineering and architectural design workflows. When a user opens a malicious DGN file, the parsing routine fails to properly validate buffer boundaries, allowing attackers to inject malicious code that executes within the context of the current process. This allows adversaries to perform actions such as installing malware, modifying system files, establishing persistence mechanisms, or exfiltrating sensitive data from the target environment. The vulnerability's exploitation requires careful crafting of DGN file structures to trigger the buffer overflow condition, which aligns with ATT&CK technique T1203 for Exploitation for Client Execution and T1059 for Command and Scripting Interpreter, as attackers may leverage the compromised system to execute additional malicious commands or payloads.
Security professionals should consider implementing multiple layers of defense to protect against exploitation of CVE-2022-28644, beginning with immediate patching of affected Bentley MicroStation installations to the latest available version that addresses this buffer overflow condition. Organizations should also deploy network segmentation to limit access to engineering and design workstations that may process DGN files, while implementing strict file validation policies that prevent unauthorized DGN files from being opened. The vulnerability's requirement for user interaction creates opportunities for defensive measures such as email filtering, web application firewalls, and user awareness training to prevent accidental exploitation. Additionally, monitoring for unusual file access patterns and suspicious network activity related to DGN file processing can help detect potential exploitation attempts. Security teams should also consider implementing application whitelisting policies that restrict which applications can open DGN files, and establish incident response procedures specifically tailored to handle potential exploitation of this type of vulnerability. The ZDI-CAN-16469 reference indicates that this vulnerability was identified through coordinated disclosure channels, emphasizing the importance of maintaining up-to-date threat intelligence and vulnerability management processes to prevent exploitation of known vulnerabilities in widely-used engineering software platforms.