CVE-2017-0148KEV · OVERDUE

Microsoft SMBv1 Server Remote Code Execution Vulnerability

High · published March 17, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.1. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1639
days past CISA
deadline
CVSS v3.1
8.1
EPSS
99%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 A crafty packet can turn your server into a playground for attackers! This vulnerability in the SMBv1 server allows for remote code execution on several Windows versions, including Windows 7 and 10! 🔥 Think of it like a delivery service that accepts packages without checking the sender. If a malicious actor crafts the right packet, they can slip harmful code right inside your network, just like a dangerous delivery slipping through the front door unnoticed. An attacker can exploit this vulnerability to execute arbitrary code on vulnerable systems, potentially taking complete control of your server! This could lead to data theft, system manipulation, or a complete takeover of your infrastructure—an absolutely devastating scenario for any organization.

Put simply

Think of it like a delivery service that accepts packages without checking the sender. If a malicious actor crafts the right packet, they can slip harmful code right inside your network, just like a dangerous delivery slipping through the front door unnoticed. The SMBv1 server in various Windows versions is vulnerable to remote code execution via specially crafted packets, which can allow an attacker to run any code they choose on the affected system, leading to unauthorized access and control.

What to do

An attacker can exploit this vulnerability to execute arbitrary code on vulnerable systems, potentially taking complete control of your server! This could lead to data theft, system manipulation, or a complete takeover of your infrastructure—an absolutely devastating scenario for any organization. Update your systems immediately to the latest patches provided by Microsoft. Disable SMBv1 if it's not needed—this can significantly reduce your attack surface! Regularly review your network configurations to ensure no outdated protocols are in use. You've got this! Stay proactive and your systems will be more secure in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99356 · 99.9th percentile
Published
2017-03-17T00:00Z
KEV added
2022-04-06 · due 2022-04-27
EPSS history
Timeline
  • 06 APR 00:00Z
    Added to CISA KEV — remediate by Apr 27
    kev
  • 17 MAR 00:00Z
    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT…
    cvelistv5