CVE-2022-28301 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16392.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/17/2026
The vulnerability identified as CVE-2022-28301 represents a critical buffer overflow flaw in Bentley MicroStation CONNECT version 10.16.02.34 which enables remote code execution through malicious IFC file manipulation. This vulnerability falls under CWE-121, which specifically addresses stack-based buffer overflow conditions, and aligns with ATT&CK technique T1059.007 for command and script injection. The flaw manifests during the parsing of Industry Foundation Classes files, a standard format used for exchanging building information modeling data between different software platforms.
The technical implementation of this vulnerability occurs when the affected software processes specially crafted IFC files containing malformed data structures that cause the application to write beyond the bounds of allocated memory buffers. This write past the end of buffer condition creates a scenario where attacker-controlled data can overwrite adjacent memory locations, potentially corrupting program execution flow and allowing arbitrary code execution within the context of the current process. The vulnerability requires user interaction to be exploited, specifically requiring the target to open a malicious IFC file or visit a webpage hosting such content, making it a typical client-side attack vector.
From an operational perspective, this vulnerability poses significant risk to organizations using Bentley MicroStation for architectural, engineering, and construction projects where IFC files are routinely exchanged between different stakeholders. The attack surface extends across multiple industries including construction, manufacturing, and infrastructure development where these software tools are extensively deployed. The remote exploitation capability means that attackers can deliver malicious IFC files through various vectors including email attachments, web downloads, or compromised collaboration platforms without requiring physical access to the target system.
Security mitigation strategies should prioritize immediate patching of affected systems to the latest version of Bentley MicroStation CONNECT where this vulnerability has been addressed by the vendor. Organizations should implement strict file validation procedures for IFC files received from external sources, deploy network-based intrusion detection systems to monitor for suspicious file transfers, and establish user education programs to prevent accidental opening of malicious files. Additionally, implementing application whitelisting controls and restricting file execution permissions can provide additional defense layers. The vulnerability demonstrates the importance of secure coding practices in handling external data formats and underscores the need for comprehensive input validation and memory management controls in enterprise software applications.