CVE-2017-0144
Microsoft SMBv1 Remote Code Execution Vulnerability
Description
CVE-2017-0144 is a HIGH severity remote code execution vulnerability in the SMBv1 server across multiple Microsoft Windows versions, with a CVSS 3.1 score of 8.8. Known worldwide by its NSA exploit codename "EternalBlue," this is arguably the most consequential vulnerability of the modern era. The flaw allows remote attackers to execute arbitrary code by sending crafted packets to the SMBv1 service on TCP port 445. EternalBlue was the primary propagation mechanism in the WannaCry ransomware pandemic of May 2017 and the NotPetya destructive attack of June 2017, together causing an estimated $10+ billion in global damages. CISA's KEV catalog confirms ransomware association, with a listing date of February 10, 2022, and remediation deadline of August 10, 2022. The EPSS score of 94.30% (99.94th percentile) is among the highest recorded.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | server message block | 1.0 |
| siemens | acuson p300 firmware | 13.02; 13.03; 13.20; 13.21 |
| siemens | acuson p500 firmware | va10; vb10 |
| siemens | acuson sc2000 firmware | >= 4.0, < 4.0e; 5.0a |
| siemens | acuson x700 firmware | 1.0; 1.1 |
| siemens | syngo sc2000 firmware | >= 4.0, < 4.0e; 5.0a |
| siemens | tissue preparation system firmware | All versions |
| siemens | versant kpcr molecular system firmware | All versions |
| siemens | versant kpcr sample prep firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/96704(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037991(Broken Link, Third Party Advisory, VDB Entry)
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf(Third Party Advisory)
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02(Third Party Advisory, US Government Resource)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41891/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41987/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42030/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42031/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0144(US Government Resource)
Weakness Type
SMBv1 Buffer Overflow Vulnerability
CVE-2017-0144 does not have a formally assigned CWE, but the underlying weakness is a buffer overflow in the SMBv1 protocol handler within the Windows kernel. The vulnerability exists because the SMBv1 server driver (srv.sys) fails to properly validate and handle certain transaction request types, allowing an attacker to overflow a kernel buffer and achieve arbitrary code execution.
The SMBv1 protocol, designed in the 1980s, carries significant architectural debt. Its complex message handling, combined with direct kernel-mode implementation in Windows, creates conditions where parsing errors have catastrophic consequences. Unlike modern protocol implementations that run in user-space with reduced privileges, the SMBv1 server operates in kernel mode, meaning any exploitation immediately yields the highest system privileges.
Impact Analysis
CVE-2017-0144 carries a CVSS 3.1 base score of 8.8 (HIGH), but its real-world impact has been catastrophic on a global scale.
Confidentiality (High): Remote kernel-level code execution provides unrestricted access to all system data. The SMBv1 service runs as SYSTEM, granting the attacker access to credentials, encryption keys, documents, and any data on the machine or accessible network resources.
Integrity (High): SYSTEM-level access allows modification of any file, installation of rootkits and persistent implants, creation of administrative accounts, and deployment of destructive payloads. NotPetya used this access to overwrite master boot records, rendering systems permanently inoperable.
Availability (High): The availability impact has been the most visible. WannaCry encrypted files across hundreds of thousands of systems in over 150 countries, shutting down hospitals, factories, and government agencies. NotPetya caused multi-billion dollar losses at companies including Maersk, Merck, and FedEx through permanent data destruction.
Ransomware confirmed: CISA explicitly flags ransomware association. EternalBlue remains one of the most widely used initial access vectors for ransomware deployment.
The EPSS score of 94.30% (99.94th percentile) confirms this as one of the most exploited vulnerabilities in history, with ongoing exploitation even years after patch availability.
Exploit Maturity
CVE-2017-0144 has the highest possible exploit maturity — weaponized by a nation-state, publicly leaked, and used in the most destructive cyber attacks in history.
NSA origin: EternalBlue was developed by the NSA's Equation Group and leaked by the Shadow Brokers on April 14, 2017, approximately one month after Microsoft released the MS17-010 patch.
Public exploits: Numerous exploit implementations exist on Exploit-DB (41891, 41987, 42030, 42031) and Packet Storm Security. The Metasploit framework includes reliable EternalBlue modules.
WannaCry pandemic (May 2017): WannaCry ransomware used EternalBlue to propagate across networks automatically, infecting an estimated 300,000+ systems in 150+ countries within days. Critical infrastructure including the UK's National Health Service was severely impacted.
NotPetya attack (June 2017): NotPetya used EternalBlue alongside EternalRomance for devastating propagation. Initially targeting Ukraine through a compromised tax software update, it spread globally and caused estimated $10+ billion in damages.
Ongoing exploitation: EternalBlue continues to be used in ransomware campaigns, cryptomining operations, and botnet propagation years after disclosure.
Remediation
-
Apply Microsoft security bulletin MS17-010 immediately. Install the patch from the MSRC advisory for all Windows versions. Microsoft released emergency patches even for end-of-life systems like Windows XP and Server 2003.
-
Disable SMBv1 on all systems. SMBv1 is deprecated and should be disabled organization-wide. Use PowerShell:
Set-SmbServerConfiguration -EnableSMB1Protocol $falseor disable via Windows Features. Audit for any applications that still require SMBv1 and plan migrations. -
Block SMB ports at all network boundaries. Block TCP 445 and 139 at perimeter firewalls. Implement internal network segmentation to prevent SMB-based lateral movement between network zones.
-
Perform enterprise-wide vulnerability scanning. Scan all network segments for systems with exposed SMBv1 services. Pay special attention to legacy systems, embedded devices, medical equipment, and industrial control systems that may run outdated Windows versions.
-
Deploy network intrusion detection. Implement IDS/IPS signatures for EternalBlue exploitation attempts. Monitor for DOUBLEPULSAR backdoor implant communications and anomalous SMB traffic patterns.
-
Verify backup integrity and test restoration procedures. Given the ransomware association, ensure offline backups are current and tested. Implement the 3-2-1 backup strategy with at least one air-gapped copy to survive ransomware attacks.
Technical Details
CVE-2017-0144, "EternalBlue," is a remote code execution vulnerability in the Microsoft SMBv1 server. It exploits a buffer overflow in the Windows kernel's SMB driver to achieve arbitrary code execution with SYSTEM privileges.
Attack vector and prerequisites: Network-based (AV:N), low complexity (AC:L), requires low privileges (PR:L) — a valid SMB session, which can be established with null credentials in many configurations. No user interaction required (UI:N).
Exploitation mechanism: The exploit targets the SMBv1 protocol's handling of Transaction 2 (TRANS2) requests. By sending a series of carefully crafted SMB packets, the attacker triggers a buffer overflow in the srv.sys kernel driver's pool allocation handling. The overflow overwrites adjacent kernel pool memory, and through pool grooming techniques, the attacker gains control of execution flow to run arbitrary code at Ring 0.
Key technical details: The exploit leverages a specific flaw in how srv.sys handles the SMB_COM_TRANSACTION2 subcommand when processing SMB_COM_NT_TRANSACT requests that are larger than the MaxBufferSize field. The size miscalculation leads to a kernel pool overflow that can be controlled for reliable exploitation.
Wormable nature: The vulnerability requires no user interaction and can be exploited across networks, making it inherently wormable. WannaCry demonstrated this by propagating automatically across networks and the internet.
Affected systems: All Windows versions supporting SMBv1, from Windows XP through Windows Server 2016. Siemens medical devices running embedded Windows are also affected.
Frequently Asked Questions
What is CVE-2017-0144?
CVE-2017-0144, known as "EternalBlue," is a remote code execution vulnerability in the Microsoft SMBv1 server. Developed by the NSA and leaked by the Shadow Brokers in April 2017, it allows attackers to execute code with SYSTEM privileges by sending crafted packets to TCP port 445. It is the vulnerability behind the WannaCry and NotPetya attacks.
Why is CVE-2017-0144 so significant?
EternalBlue enabled the two most destructive cyber attacks in history. WannaCry (May 2017) infected 300,000+ systems across 150+ countries, and NotPetya (June 2017) caused $10+ billion in global damages. The vulnerability's wormable nature allows automatic propagation without user interaction, making it exceptionally dangerous.
How do I fix CVE-2017-0144?
Apply MS17-010 and disable SMBv1 entirely across your organization. Block SMB ports 445 and 139 at network boundaries. Scan all systems for exposed SMBv1 services and DOUBLEPULSAR implants. Ensure offline backups are current given the ransomware association.
Is CVE-2017-0144 still being exploited?
Yes. Despite patches being available since March 2017, EternalBlue remains one of the most exploited vulnerabilities worldwide. Its EPSS score of 94.30% (99.94th percentile) confirms ongoing active exploitation. Legacy systems, unpatched environments, and lack of SMBv1 disabling continue to provide targets for ransomware operators and other threat actors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.