CVE-2022-28318 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16379.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/18/2026
CVE-2022-28318 represents a critical buffer overflow vulnerability affecting Bentley MicroStation CONNECT version 10.16.02.34 that enables remote code execution through crafted IFC (Industry Foundation Classes) files. This vulnerability resides within the IFC file parsing component of the software, specifically manifesting as a write past the end of an allocated buffer when processing maliciously constructed data. The flaw constitutes a classic buffer overflow condition that can be exploited by attackers who craft specially formatted IFC files designed to trigger the vulnerability during normal file parsing operations. The vulnerability requires user interaction to be successfully exploited, meaning that targets must either visit a malicious webpage hosting the crafted IFC file or open the malicious file directly within the application context. This requirement aligns with attack patterns described in the ATT&CK framework under initial access and execution phases, where adversaries leverage user interaction to deliver malicious payloads. The technical implementation of this vulnerability falls under CWE-121, which specifically addresses stack-based buffer overflow conditions, and potentially CWE-787, which covers out-of-bounds write vulnerabilities. The buffer overflow occurs during the parsing of IFC file structures where insufficient bounds checking allows an attacker to write data beyond the intended memory boundaries, potentially corrupting adjacent memory regions and enabling arbitrary code execution. The exploitation process leverages the fact that IFC files are commonly used in construction and engineering workflows, making them legitimate targets for social engineering attacks where users might encounter malicious files in routine business operations. When successfully exploited, this vulnerability allows attackers to execute code within the security context of the current process, potentially leading to complete system compromise. The attack surface is particularly concerning given that IFC files are standard interchange formats in the AEC (Architecture, Engineering, Construction) industry, making the attack vector highly relevant in professional environments where these files are regularly exchanged between different software platforms. This vulnerability directly impacts the integrity and availability of engineering and design workflows, as attackers could potentially disrupt critical infrastructure projects or gain unauthorized access to sensitive design data. The vulnerability's classification as a remote code execution flaw means that attackers do not need physical access to target systems, enabling them to compromise installations from remote locations through web-based delivery mechanisms or file sharing channels. Security professionals should consider implementing network-based protections such as web application firewalls and file integrity monitoring systems to detect and prevent exploitation attempts. Additionally, user education regarding the risks of opening untrusted IFC files and implementing strict access controls for engineering environments can help mitigate the potential impact of this vulnerability. Organizations should prioritize patch management and ensure that all instances of Bentley MicroStation CONNECT are updated to versions that address this specific buffer overflow condition, as the vulnerability represents a significant risk to operational security in engineering and construction environments where these applications are extensively deployed. The incident highlights the importance of input validation and bounds checking in industrial software applications, particularly those handling complex data interchange formats that are integral to professional workflows.