CVE-2022-28644
📋 TL;DR
CVE-2022-28644 is a buffer overflow vulnerability in Bentley MicroStation CONNECT that allows remote code execution when users open malicious DGN files. Attackers can exploit this to execute arbitrary code with the privileges of the current user. Users of affected Bentley MicroStation versions are at risk.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive engineering data, system disruption, or malware installation.
If Mitigated
Limited impact with proper security controls, potentially only application crash or denial of service.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but the vulnerability itself is straightforward to exploit once the malicious file is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.02.35 and later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004
Restart Required: Yes
Instructions:
1. Download the latest version from Bentley's official website or update through the application's update mechanism. 2. Install the update following Bentley's installation instructions. 3. Restart the system to ensure all components are properly updated.
🔧 Temporary Workarounds
Restrict DGN file handling
windowsConfigure system to open DGN files only with trusted applications or in sandboxed environments
User awareness training
allTrain users to only open DGN files from trusted sources and verify file integrity
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Use network segmentation to isolate MicroStation systems from critical infrastructure
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version via Help > About in the application interfaceCheck Version:
Not applicable - check through application GUIVerify Fix Applied:
Verify version is 10.16.02.35 or later in Help > About📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing DGN files
- Unusual process creation from MicroStation executable
Network Indicators:
- Outbound connections from MicroStation to unexpected destinations
- File downloads followed by MicroStation process execution
SIEM Query:
Process Creation where Image contains 'ustation.exe' AND ParentImage contains 'explorer.exe' AND CommandLine contains '.dgn'