peter bassill · operator
$ cve CVE-2017-0144 JSON

CVE-2017-0144 KEV EXPLOIT

8.8
HIGH · CVSS 3.1 · EPSS 99.2% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-08-10.

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Scoring

CVSS8.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS99.23% — more likely to be exploited than 100% of all CVEs
On CISA KEVyes — remediate by 2022-08-10
Public exploityes
Published2017-03-17
Last modified2026-08-14

CISA KEV

NameMicrosoft SMBv1 Remote Code Execution Vulnerability
Added2022-02-10
Due2022-08-10
Vendor / productMicrosoft / SMBv1
Ransomware useknown

Affected (27)

VendorProduct
microsoftserver message block
microsoftwindows 10 1507
microsoftwindows 10 1511
microsoftwindows 10 1607
microsoftwindows 7
microsoftwindows 8.1
microsoftwindows rt 8.1
microsoftwindows server 2008
microsoftwindows server 2012
microsoftwindows server 2016
microsoftwindows vista
siemensacuson p300
siemensacuson p300 firmware
siemensacuson p500
siemensacuson p500 firmware
siemensacuson sc2000
siemensacuson sc2000 firmware
siemensacuson x700
siemensacuson x700 firmware
siemenssyngo sc2000
siemenssyngo sc2000 firmware
siemenstissue preparation system
siemenstissue preparation system firmware
siemensversant kpcr molecular system
siemensversant kpcr molecular system firmware
siemensversant kpcr sample prep
siemensversant kpcr sample prep firmware

Public exploits

SourceTitleDate
exploit-dbDOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)2019-10-02
exploit-dbMicrosoft Windows 7/8.1/2008 R2/2012 R2/2016 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010)2017-07-11
exploit-dbMicrosoft Windows 8/8.1/2012 R2 (x64) - 'EternalBlue' SMB Remote Code Execution (MS17-010)2017-05-17
exploit-dbMicrosoft Windows 7/2008 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010)2017-05-17
exploit-dbMicrosoft Windows Server 2008 R2 (x64) - 'SrvOs2FeaToNt' SMB Remote Code Execution (MS17-010)2017-05-10
exploit-dbMicrosoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit)2017-04-17

References

→ the Explorer  ·  watch your stack  ·  NVD