Remote Code Execution Vulnerability in Bentley MicroStation CONNECT
CVE-2022-28644

7.8HIGH

Key Information:

Vendor
Bentley
Status
Microstation Connect
Vendor
CVE Published:
29 March 2023

Summary

This vulnerability in Bentley MicroStation CONNECT allows attackers to execute arbitrary code when a user interacts with a specially crafted DGN file. When an affected user opens a malformed DGN file or visits a malicious webpage, the flaw in the file parsing could cause an out-of-bounds write, leading to code execution in the context of the user process. Proper measures should be taken to avoid opening untrusted files to mitigate potential risks.

Affected Version(s)

MicroStation CONNECT 10.16.02.34

References

https://www.bentley.com/en/common-vulnerability-exposure/...
https://www.zerodayinitiative.com/advisories/ZDI-22-611/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Mat Powell of Trend Micro Zero Day Initiative
.