CVE-2017-0148highunder attackransomwareCWE-20

CVE-2017-0148: high-severity vulnerability in Microsoft Corporation Windows SMB

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.1epss 99%
from disclosure to weapon31 days
Published on NVDMar 17
1st PoC+31d
metasploitMar 14
CISA KEV+1846d
exploitation probability
99%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
8 public exploit(s)
Action required by CISAfederal deadline: 2022-04-27

Apply updates per vendor instructions.

In short

A flaw in Microsoft Windows' SMB file-sharing protocol allows attackers to send specially crafted packets over the network and execute malicious code on vulnerable computers without needing valid credentials.

Technical detail

CWE-20 (Improper Input Validation) in SMBv1 server implementation across multiple Windows versions enables remote code execution via maliciously crafted SMB packets. No authentication or user interaction is required; exploitation occurs at the network level during packet processing.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Microsoft Corporation · Windows SMB
public PoCs found — 8✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/41891exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47456exploitdbwww.exploit-db.com/exploits/41987unverifiedcve_referencewww.exploit-db.com/exploits/41987/unverifiedcve_referencepacketstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.htmlunverifiedvulncheckvulncheck.com/xdb/01fbcaf8d8bdunverifiedcve_referencepacketstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.htmlunverifiedcve_referencewww.exploit-db.com/exploits/41891/unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Corporation Windows SMB

In the same product, most dangerous first.

CVE-2017-0147HIGHCVE-2017-0147EPSS 99.7%KEVCVE-2017-0144HIGHCVE-2017-0144EPSS 99.2%KEVCVE-2017-0143HIGHCVE-2017-0143EPSS 93.3%KEVCVE-2017-0146HIGHCVE-2017-0146EPSS 89.9%KEVCVE-2017-0145HIGHCVE-2017-0145EPSS 89.8%KEV
References
http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.htmlhttp://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdfhttps://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0148https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0148https://www.exploit-db.com/exploits/41891/https://www.exploit-db.com/exploits/41987/http://www.securityfocus.com/bid/96706http://www.securitytracker.com/id/1037991