CVE-2017-0144KEV · OVERDUE

Microsoft SMBv1 Remote Code Execution Vulnerability

High · published March 17, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1534
days past CISA
deadline
CVSS v3.1
8.8
EPSS
99%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 A crafty packet can take over your system! The SMBv1 server in multiple versions of Windows is vulnerable to remote code execution, making it a playground for attackers! ⚡ Think of it like a restaurant that serves food orders based solely on a receipt without checking what’s actually in it. If someone slips in a fake order, they could end up cooking a dangerous dish everyone eats! An attacker could send specially crafted packets to exploit this vulnerability, potentially leading to complete control over the affected systems. Imagine a hacker gaining access to sensitive data, changing system settings, or even deploying malicious software across a network – absolutely devastating!

Put simply

Think of it like a restaurant that serves food orders based solely on a receipt without checking what’s actually in it. If someone slips in a fake order, they could end up cooking a dangerous dish everyone eats! This vulnerability in SMBv1 allows remote attackers to execute arbitrary code by sending specifically crafted packets to the server, bypassing security controls. Essentially, the server trusts these packets without proper verification, which opens the door to exploitation.

What to do

An attacker could send specially crafted packets to exploit this vulnerability, potentially leading to complete control over the affected systems. Imagine a hacker gaining access to sensitive data, changing system settings, or even deploying malicious software across a network – absolutely devastating! To protect your systems, immediately disable SMBv1 on affected versions of Windows, and ensure your machines are updated with the latest security patches. Prioritize updating systems to versions that no longer use this vulnerable protocol. 🛡️ You've got this! By taking these steps, you'll lock down your systems and become a security hero! 🔒💪

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99230 · 99.9th percentile
Published
2017-03-17T04:59Z
KEV added
2022-02-10 · due 2022-08-10
Affected products (16)
ProductVersionsFixed in
microsoft/server_message_blockall versions—
siemens/acuson_p300_firmwareall versions—
siemens/acuson_p300_firmwareall versions—
siemens/acuson_p300_firmwareall versions—
siemens/acuson_p300_firmwareall versions—
siemens/acuson_p500_firmwareall versions—
siemens/acuson_p500_firmwareall versions—
siemens/acuson_sc2000_firmware≥ 4.0, < 4.0e4.0e
siemens/acuson_sc2000_firmwareall versions—
siemens/acuson_x700_firmwareall versions—
siemens/acuson_x700_firmwareall versions—
siemens/syngo_sc2000_firmware≥ 4.0, < 4.0e4.0e
siemens/syngo_sc2000_firmwareall versions—
siemens/tissue_preparation_system_firmwareall versions—
siemens/versant_kpcr_molecular_system_firmwareall versions—
siemens/versant_kpcr_sample_prep_firmwareall versions—
References (25)
http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html · [email protected]http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html · [email protected]http://www.securityfocus.com/bid/96704 · [email protected]http://www.securitytracker.com/id/1037991 · [email protected]https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf · [email protected]https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf · [email protected]https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 · [email protected]https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144 · [email protected]https://www.exploit-db.com/exploits/41891/ · [email protected]https://www.exploit-db.com/exploits/41987/ · [email protected]https://www.exploit-db.com/exploits/42030/ · [email protected]https://www.exploit-db.com/exploits/42031/ · [email protected]http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/96704 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1037991 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf · af854a3a-2127-422b-91ae-364da2661108https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 · af854a3a-2127-422b-91ae-364da2661108https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144 · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/41891/ · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/41987/ · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/42030/ · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/42031/ · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0144 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 FEB 00:00Z
    Added to CISA KEV — remediate by Aug 10
    kev
  • 17 MAR 00:00Z
    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT…
    cvelistv5