CVE-2022-28646 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16570.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/20/2026
The vulnerability identified as CVE-2022-28646 represents a critical buffer overflow flaw within Bentley MicroStation CONNECT version 10.16.2.034 that enables remote code execution through malicious IFC file manipulation. This vulnerability falls under the CWE-121 buffer overflow category, specifically manifesting as a write past the end of an allocated buffer during IFC file parsing operations. The flaw exists in the software's handling of Industry Foundation Classes files, which are standard formats used for exchanging building information modeling data between different software platforms in the construction industry. Attackers can exploit this vulnerability by crafting malicious IFC files that, when processed by the vulnerable software, trigger the buffer overflow condition.
The exploitation of this vulnerability requires user interaction, meaning that victims must actively engage with the malicious content by visiting a compromised webpage or opening a specially crafted IFC file. This user interaction requirement aligns with ATT&CK technique T1203, which describes the use of malicious files to gain initial access to systems. The vulnerability operates at the application level where the parsing logic fails to properly validate buffer boundaries when processing IFC file structures, allowing attackers to overwrite adjacent memory locations. The buffer overflow occurs during the parsing phase when the software attempts to write data beyond the allocated memory space, potentially overwriting critical program variables or function pointers.
The operational impact of this vulnerability extends beyond simple code execution, as it allows attackers to operate within the context of the current process with the privileges of the user running MicroStation. This means that if a user with administrative privileges opens a malicious IFC file, the attacker could gain full system control. The vulnerability affects organizations in the construction, engineering, and architecture sectors where Bentley MicroStation is commonly deployed for design and modeling tasks. The attack surface is particularly concerning given that IFC files are frequently shared between different software platforms and organizations, making them an ideal vector for supply chain attacks.
Organizations should implement immediate mitigations including updating to the latest version of Bentley MicroStation where the vulnerability has been patched, implementing strict file validation policies for IFC files received from external sources, and deploying network-based intrusion detection systems to monitor for suspicious file access patterns. Additionally, security awareness training should be provided to users to recognize potentially malicious IFC files and avoid opening untrusted files. The vulnerability demonstrates the importance of proper input validation and memory safety practices in industrial software applications, as highlighted by the CWE-121 classification that emphasizes the need for bounds checking in buffer operations. Organizations should also consider implementing application whitelisting policies and sandboxing techniques to limit the potential impact of such vulnerabilities in their environments.