CVE-2022-28314 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16332.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/18/2026
CVE-2022-28314 represents a critical buffer overflow vulnerability affecting Bentley MicroStation CONNECT version 10.16.02.34 that enables remote code execution through malicious IFC file manipulation. This vulnerability resides within the IFC file parsing component of the software, making it particularly dangerous as IFC files are commonly used for building information modeling and architectural data exchange in engineering environments. The flaw manifests when the application processes specially crafted IFC files containing malformed data that triggers a write past the end of an allocated buffer, a classic buffer overflow condition that can be exploited to overwrite adjacent memory locations. This type of vulnerability falls under CWE-121, which specifically addresses stack-based buffer overflow conditions where data written beyond buffer boundaries can corrupt adjacent memory, potentially allowing attackers to overwrite return addresses, function pointers, or other critical program data. The vulnerability requires user interaction to be exploited, meaning that victims must either visit a malicious webpage or open a malicious IFC file, making it a client-side attack vector that leverages social engineering techniques to deliver the malicious payload. From an operational perspective, this vulnerability poses significant risk to engineering firms, construction companies, and architecture firms that rely heavily on Bentley MicroStation for their design and modeling workflows, as these organizations frequently exchange IFC files between different software platforms and may unknowingly execute malicious code when processing legitimate-looking files. The attack surface expands due to the widespread use of IFC format in the construction industry, where file sharing between different stakeholders including architects, engineers, and contractors creates multiple potential entry points for exploitation. The remote code execution capability allows attackers to operate within the context of the current process, potentially gaining full system access and control over the victim's machine. This vulnerability aligns with ATT&CK technique T1059.007 for command and scripting interpreter, specifically PowerShell and Windows Command Shell, as the exploitation could enable attackers to execute arbitrary commands on the compromised system. The ZDI-CAN-16332 identifier indicates that this vulnerability was tracked by the Zero Day Initiative, highlighting its significance in the cybersecurity community and the need for immediate remediation. Organizations using Bentley MicroStation should prioritize patching this vulnerability as it represents a high-severity risk that could lead to complete system compromise and data exfiltration. The vulnerability's exploitation requires minimal user interaction beyond opening a malicious file, making it particularly dangerous in environments where users may not be security-aware and frequently process files from external sources or colleagues. Security teams should implement network monitoring to detect suspicious IFC file transfers and consider restricting file type processing in critical environments until patches are applied. The buffer overflow condition specifically affects the application's memory management during IFC parsing, where insufficient bounds checking allows malicious data to overwrite memory regions that should remain protected, potentially leading to arbitrary code execution with the privileges of the running application. This vulnerability demonstrates the importance of proper input validation and memory safety practices in software development, particularly for applications that process complex file formats from external sources. Organizations should also consider implementing sandboxing techniques for file processing and establishing secure file handling protocols to minimize the risk of exploitation. The vulnerability's impact extends beyond individual systems to potentially compromise entire engineering networks where design data is shared, as successful exploitation could provide attackers with access to sensitive architectural and engineering information that could be used for further attacks or industrial espionage.