{"id":"CVE-2017-0147","kind":"vulnerability","aliases":["CVE-2017-0147"],"related":[],"title":"Microsoft SMBv1 server: Microsoft Windows SMBv1 Information Disclosure Vulnerability","description":"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka \"Windows SMB Information Disclosure Vulnerability.\"","summary":"The SMBv1 server in Microsoft Windows leaks bytes from process memory when it receives a specially crafted network packet. An attacker who can reach the SMB port can read sensitive information from the server's memory without logging in.","severity":"high","cvss":7.5,"epss":0.99693,"exploited":true,"exploited_at":"2022-05-24T00:00:00+00:00","products":[{"name":"Microsoft SMBv1 server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","file-servers","infrastructure","ransomware","smbv1","windows"],"not_affected_if":["no-smb-exposure","smbv1-disabled"],"how_to_check":null,"fix":"Apply the Microsoft update for this CVE per vendor instructions; the sources do not name the exact KB or build. Disable SMBv1 on Windows systems if it is not required.","status":"open","published_at":"2017-03-17T00:59:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:52+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:15:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for this CVE per vendor instructions; the sources do not name the exact KB or build. Disable SMBv1 on Windows systems if it is not required.","reach":"network","impact":"medium","summary":"The SMBv1 server in Microsoft Windows leaks bytes from process memory when it receives a specially crafted network packet. An attacker who can reach the SMB port can read sensitive information from the server's memory without logging in.","category":"infrastructure","who_cares":["windows","smbv1","file-servers"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads sensitive process memory remotely, which is used in ransomware campaigns","analyst_note":"Find the exact patched KB list and the SMBv1 disable steps from Microsoft's MS17-010 bulletin and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["smbv1-disabled","no-smb-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2841,"output_tokens":382,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0147':12A,15A '-2017':11A,14A '10':96C '1511':98C '1607':100C '2008':75C '2012':87C '2016':104C '7':81C '8.1':84C,93C 'aka':119C 'allow':105C 'attack':47B,107C 'byte':34B 'craft':43B,117C 'cve':10A,13A 'disclosur':8A,123C 'exploit':19B 'file':21B 'file-serv':20B 'gold':88C,97C 'inform':7A,57B,111C,122C 'infrastructur':23B 'leak':33B 'log':64B 'memori':37B,62B,114C 'microsoft':1A,4A,16A,31B,69C 'network':44B 'obtain':109C 'packet':45B,118C 'port':53B 'process':36B,113C 'r2':78C,90C 'ransomwar':24B 'reach':50B 'read':55B 'receiv':40B 'remot':106C 'rt':92C 'sensit':56B,110C 'server':3A,18A,22B,29B,60B,67C,74C,86C,103C 'smb':52B,121C 'smbv1':2A,6A,17A,25B,28B,66C 'sp1':79C,82C 'sp2':72C,76C 'special':42B 'via':115C 'vista':71C 'vulner':9A,124C 'window':5A,26B,32B,70C,73C,80C,83C,85C,91C,95C,102C,120C 'without':63B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-03-17T00:59:04+00:00","kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-0147","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0147","severity":null,"published_at":"2022-05-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2017-0147","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0147","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-0147","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0147","severity":null,"published_at":"2017-03-17T00:59:04+00:00","modified_at":"2026-06-17T00:57:09+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}