{"id":"CVE-2017-0145","kind":"vulnerability","aliases":["CVE-2017-0145"],"related":[],"title":"Microsoft SMBv1: Microsoft SMBv1 Remote Code Execution Vulnerability","description":"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.","summary":"The SMBv1 server in multiple Windows versions lets a remote attacker run arbitrary code by sending crafted packets. It is on CISA's known-exploited list and is tagged as used in ransomware campaigns (EternalBlue class).","severity":"critical","cvss":9.3,"epss":0.8985,"exploited":true,"exploited_at":"2022-02-10T00:00:00+00:00","products":[{"name":"Microsoft SMBv1","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","smb","windows"],"not_affected_if":["no-windows-hosts","smbv1-disabled"],"how_to_check":null,"fix":"Apply Microsoft's security updates for SMBv1 per vendor instructions (CISA required action). Disable SMBv1 if it is not needed; the sources do not give the exact command.","status":"open","published_at":"2017-03-17T00:59:04+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:28:48+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:28:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply Microsoft's security updates for SMBv1 per vendor instructions (CISA required action). Disable SMBv1 if it is not needed; the sources do not give the exact command.","reach":"network","impact":"high","summary":"The SMBv1 server in multiple Windows versions lets a remote attacker run arbitrary code by sending crafted packets. It is on CISA's known-exploited list and is tagged as used in ransomware campaigns (EternalBlue class).","category":"infrastructure","who_cares":["windows","smb","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Windows host via crafted SMB packets.","analyst_note":"Find the exact affected Windows builds, the MS17-010 bulletin, and a SMBv1 disable command at the Microsoft advisory for CVE-2017-0145.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["smbv1-disabled","no-windows-hosts"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000482,"input_tokens":2836,"output_tokens":396,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0143':129C '-0144':132C '-0145':11A,14A '-0146':135C '-0148':139C '-2017':10A,13A,128C,131C,134C,138C '10':93C '1511':95C '1607':97C '2008':72C '2012':84C '2016':101C '7':78C '8.1':81C,90C 'aka':112C 'allow':102C 'arbitrari':37B,107C 'attack':35B,104C 'campaign':59B 'cisa':46B 'class':61B 'code':6A,38B,108C,116C 'craft':41B,110C 'cve':9A,12A,127C,130C,133C,137C 'describ':125C 'differ':122C 'eternalblu':60B 'execut':7A,106C,117C 'exploit':17B,50B 'gold':85C,94C 'host':22B 'infrastructur':18B 'known':49B 'known-exploit':48B 'let':32B 'list':51B 'microsoft':1A,3A,15A,66C 'multipl':29B 'packet':42B,111C 'r2':75C,87C 'ransomwar':19B,58B 'remot':5A,34B,103C,115C 'rt':89C 'run':36B 'self':21B 'self-host':20B 'send':40B 'server':27B,64C,71C,83C,100C 'smb':23B,114C 'smbv1':2A,4A,16A,26B,63C 'sp1':76C,79C 'sp2':69C,73C 'tag':54B 'use':56B 'version':31B 'via':109C 'vista':68C 'vulner':8A,118C,120C 'window':24B,30B,67C,70C,77C,80C,82C,88C,92C,99C,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-03-17T00:59:04+00:00","kev":{"dateAdded":"2022-02-10","dueDate":"2022-08-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-0145","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0145","severity":null,"published_at":"2022-02-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2017-0145","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0145","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-0145","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0145","severity":null,"published_at":"2017-03-17T00:59:04+00:00","modified_at":"2026-08-14T05:16:54+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}