Remote Code Execution in Bentley MicroStation CONNECT Software

CVE-2022-28314

Summary

A vulnerability in Bentley MicroStation CONNECT allows remote attackers to execute arbitrary code. This issue arises during the parsing of IFC files, which may lead to a buffer overflow if crafted data is supplied. User interaction is necessary as victims must either visit a malicious webpage or open a contaminated file to trigger the exploit. Successful exploitation enables attackers to execute code within the context of the affected software process, potentially compromising system integrity.

References