CVE-2017-0147 KEV EXPLOIT
7.5
HIGH · CVSS 3.1 · EPSS 99.7% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2022-06-14.
Description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."
Scoring
| CVSS | 7.5 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 99.69% — more likely to be exploited than 100% of all CVEs |
| On CISA KEV | yes — remediate by 2022-06-14 |
| Public exploit | yes |
| Published | 2017-03-17 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Microsoft Windows SMBv1 Information Disclosure Vulnerability |
|---|---|
| Added | 2022-05-24 |
| Due | 2022-06-14 |
| Vendor / product | Microsoft / SMBv1 server |
| Ransomware use | known |
Affected (26)
| Vendor | Product |
|---|---|
| microsoft | windows 10 1507 |
| microsoft | windows 10 1511 |
| microsoft | windows 10 1607 |
| microsoft | windows 7 |
| microsoft | windows 8.1 |
| microsoft | windows rt 8.1 |
| microsoft | windows server 2008 |
| microsoft | windows server 2012 |
| microsoft | windows server 2016 |
| microsoft | windows vista |
| siemens | acuson p300 |
| siemens | acuson p300 firmware |
| siemens | acuson p500 |
| siemens | acuson p500 firmware |
| siemens | acuson sc2000 |
| siemens | acuson sc2000 firmware |
| siemens | acuson x700 |
| siemens | acuson x700 firmware |
| siemens | syngo sc2000 |
| siemens | syngo sc2000 firmware |
| siemens | tissue preparation system |
| siemens | tissue preparation system firmware |
| siemens | versant kpcr molecular system |
| siemens | versant kpcr molecular system firmware |
| siemens | versant kpcr sample prep |
| siemens | versant kpcr sample prep firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit) | 2019-10-02 |
| exploit-db | Microsoft Windows - 'EternalRomance'/'EternalSynergy'/'EternalChampion' SMB Remote Code Execution (Metasploit) (MS17-010) | 2018-02-05 |
| exploit-db | Microsoft Windows Server 2008 R2 (x64) - 'SrvOs2FeaToNt' SMB Remote Code Execution (MS17-010) | 2017-05-10 |
| exploit-db | Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit) | 2017-04-17 |
References
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/96709
- http://www.securitytracker.com/id/1037991
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0147
- https://www.exploit-db.com/exploits/41891/
- https://www.exploit-db.com/exploits/41987/
- https://www.exploit-db.com/exploits/43970/
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/96709
- http://www.securitytracker.com/id/1037991
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0147
- https://www.exploit-db.com/exploits/41891/
→ the Explorer · watch your stack · NVD