Remote Code Execution Vulnerability in Bentley MicroStation by Bentley

CVE-2022-28647

Summary

This vulnerability enables remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. Exploiting the flaw requires user interaction, as it involves the target visiting a malicious page or opening a crafted file. The vulnerability arises from improper parsing of IFC files, allowing specially crafted data to trigger a read beyond the end of an allocated buffer. Consequently, an attacker can execute code within the context of the current process, potentially compromising system integrity. For further details, refer to the sources provided.

References