{"id":"CVE-2017-0144","kind":"vulnerability","aliases":["CVE-2017-0144"],"related":[],"title":"Microsoft SMBv1: Microsoft SMBv1 Remote Code Execution Vulnerability","description":"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.","summary":"The SMBv1 server in multiple Windows versions lets remote attackers run arbitrary code by sending crafted packets. This is the EternalBlue flaw, actively exploited and used in ransomware campaigns.","severity":"critical","cvss":9.3,"epss":0.9923,"exploited":true,"exploited_at":"2022-02-10T00:00:00+00:00","products":[{"name":"Microsoft SMBv1","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","file-servers","infrastructure","ransomware","smbv1","windows"],"not_affected_if":["patched-windows","smbv1-disabled"],"how_to_check":null,"fix":"Apply the Microsoft update for MS17-010 per vendor instructions; the sources do not name the KB numbers.\nDisable SMBv1 if no legacy system still needs it; the sources do not give the exact command.","status":"open","published_at":"2017-03-17T00:59:04+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:28:48+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:28:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for MS17-010 per vendor instructions; the sources do not name the KB numbers.\nDisable SMBv1 if no legacy system still needs it; the sources do not give the exact command.","reach":"network","impact":"high","summary":"The SMBv1 server in multiple Windows versions lets remote attackers run arbitrary code by sending crafted packets. This is the EternalBlue flaw, actively exploited and used in ransomware campaigns.","category":"infrastructure","who_cares":["windows","smbv1","file-servers"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Windows host remotely.","analyst_note":"Find the exact patch KBs per Windows version and the SMBv1 disable command in Microsoft's MS17-010 bulletin; the sources here do not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["smbv1-disabled","patched-windows"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000477,"input_tokens":2836,"output_tokens":386,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0143':121C '-0144':11A,14A '-0145':124C '-0146':127C '-0148':131C '-2017':10A,13A,120C,123C,126C,130C '10':85C '1511':87C '1607':89C '2008':64C '2012':76C '2016':93C '7':70C '8.1':73C,82C 'activ':47B 'aka':104C 'allow':94C 'arbitrari':36B,99C 'attack':34B,96C 'campaign':53B 'code':6A,37B,100C,108C 'craft':40B,102C 'cve':9A,12A,119C,122C,125C,129C 'describ':117C 'differ':114C 'eternalblu':45B 'execut':7A,98C,109C 'exploit':17B,48B 'file':19B 'file-serv':18B 'flaw':46B 'gold':77C,86C 'infrastructur':21B 'let':32B 'microsoft':1A,3A,15A,58C 'multipl':29B 'packet':41B,103C 'r2':67C,79C 'ransomwar':22B,52B 'remot':5A,33B,95C,107C 'rt':81C 'run':35B 'send':39B 'server':20B,27B,56C,63C,75C,92C 'smb':106C 'smbv1':2A,4A,16A,23B,26B,55C 'sp1':68C,71C 'sp2':61C,65C 'use':50B 'version':31B 'via':101C 'vista':60C 'vulner':8A,110C,112C 'window':24B,30B,59C,62C,69C,72C,74C,80C,84C,91C,105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-03-17T00:59:04+00:00","kev":{"dateAdded":"2022-02-10","dueDate":"2022-08-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-0144","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0144","severity":null,"published_at":"2022-02-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2017-0144","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0144","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-0144","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0144","severity":null,"published_at":"2017-03-17T00:59:04+00:00","modified_at":"2026-08-14T05:16:53+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}