CVE-2022-28317 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16369.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/18/2026
CVE-2022-28317 represents a critical memory initialization vulnerability affecting Bentley MicroStation CONNECT version 10.16.02.34 that enables remote code execution through improper handling of IFC file parsing. This vulnerability falls under the CWE-457 category of "Use of Uninitialized Variable" and specifically manifests when the software fails to properly initialize memory before accessing it during IFC file processing. The flaw exists within the application's file parsing mechanism where it encounters uninitialized memory locations that are subsequently accessed without proper validation, creating a predictable attack surface for remote exploitation.
The attack vector requires user interaction through visiting malicious web pages or opening compromised IFC files, making this a typical client-side exploitation scenario. According to ATT&CK framework, this vulnerability maps to T1203 - Exploitation for Client Execution and T1059 - Command and Scripting Interpreter, as attackers can leverage the uninitialized memory access to inject and execute arbitrary code within the application's process context. The vulnerability's impact extends beyond simple code execution to potentially allow full system compromise when combined with other attack techniques, particularly since the exploitation occurs within the privileged context of the running MicroStation application.
The technical implications of this vulnerability are severe as it allows attackers to execute code with the same privileges as the MicroStation process, potentially enabling privilege escalation attacks, data exfiltration, or further network infiltration. Memory initialization failures of this nature often provide attackers with predictable memory layouts and can be combined with other techniques such as return-oriented programming or just-in-time compilation attacks to achieve reliable exploitation. The vulnerability's classification as a remote code execution flaw means that attackers can compromise systems without physical access, making it particularly dangerous in enterprise environments where such software is widely deployed.
Organizations should implement immediate mitigations including restricting user access to potentially malicious IFC files, implementing web application firewalls to block suspicious file downloads, and ensuring all systems are updated to patched versions of Bentley MicroStation. The vulnerability's presence in a widely used CAD software platform makes it particularly attractive to threat actors targeting industrial control systems and engineering environments. Security teams should also consider network segmentation to limit the potential impact of successful exploitation and implement monitoring for unusual file access patterns or network connections originating from affected systems. Regular security assessments and vulnerability scanning should be conducted to identify any additional instances of this vulnerability across the enterprise infrastructure.