CVE-2022-28647 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16573.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/20/2026
CVE-2022-28647 represents a critical buffer overread vulnerability affecting Bentley MicroStation CONNECT version 10.16.2.034, classified under CWE-125 as an "Out-of-bounds Read" flaw. This vulnerability manifests during the parsing of Industry Foundation Classes IFC files, which are widely used in building information modeling and construction industry applications. The flaw occurs when the software processes malformed IFC data structures that cause the application to read memory beyond the bounds of allocated buffer space, creating a potential entry point for remote code execution.
The exploitation of this vulnerability requires user interaction through either visiting a malicious webpage or opening a specially crafted IFC file, making it a typical client-side attack vector that aligns with ATT&CK technique T1203 - Exploitation for Client Execution. The buffer overread condition allows attackers to access memory locations that should not be accessible, potentially enabling them to execute arbitrary code within the context of the current process. This privilege escalation capability makes the vulnerability particularly dangerous as it could allow attackers to gain full control over the affected system without requiring elevated privileges.
The operational impact of this vulnerability extends beyond simple code execution, as it affects a widely used engineering and design software platform that operates in sensitive industrial environments. Organizations utilizing Bentley MicroStation for critical infrastructure design, architectural planning, and construction management face significant risks when this vulnerability is exploited. The vulnerability's remote exploitability combined with the requirement for user interaction means that social engineering campaigns targeting specific organizations could be particularly effective, as employees might unknowingly open malicious IFC files during legitimate work processes.
Security mitigations for this vulnerability should focus on immediate patch management, as the vendor has released updates addressing this specific buffer overread condition. Organizations should implement strict file validation protocols for IFC files, particularly when these files originate from external sources or untrusted networks. Network segmentation and application whitelisting can help reduce the attack surface, while user awareness training should emphasize the dangers of opening unknown or unverified IFC files. Additionally, implementing automated monitoring for suspicious file access patterns and maintaining up-to-date threat intelligence regarding similar vulnerabilities in engineering software platforms will help organizations detect and respond to potential exploitation attempts more effectively.