CVE-2017-0148
Microsoft SMBv1 Server Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-04-06. Federal due date: 2022-04-27.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)2019-10-02 · remote · windows · Verified
- Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit)2017-04-17 · dos · windows · Verified
- Microsoft Windows Server 2008 R2 (x64) - 'SrvOs2FeaToNt' SMB Remote Code Execution (MS17-010)2017-05-10 · remote · windows_x86-64
Impact
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Server Message Block | Version 1.0 |
| Siemens | Acuson P300 Firmware | Versions 13.02, 13.03, 13.20, 13.21 |
| Siemens | Acuson P500 Firmware | Versions va10, vb10 |
| Siemens | Acuson Sc2000 Firmware | from 4.0 before 4.0e Version 5.0a |
| Siemens | Acuson X700 Firmware | Versions 1.0, 1.1 |
| Siemens | Syngo Sc2000 Firmware | from 4.0 through 4.0e Version 5.0a |
| Siemens | Tissue Preparation System Firmware | All versions |
| Siemens | Versant Kpcr Molecular System Firmware | All versions |
| Siemens | Versant Kpcr Sample Prep Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/96706
- http://www.securitytracker.com/id/1037991
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0148
- https://www.exploit-db.com/exploits/41891/
- https://www.exploit-db.com/exploits/41987/
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/96706
- http://www.securitytracker.com/id/1037991
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0148
- https://www.exploit-db.com/exploits/41891/
- https://www.exploit-db.com/exploits/41987/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0148