CVE-2017-0145
Microsoft SMBv1 Remote Code Execution Vulnerability
Description
CVE-2017-0145 is a HIGH severity remote code execution vulnerability in the SMBv1 server implementation across multiple Microsoft Windows versions, carrying a CVSS 3.1 score of 8.8. The vulnerability allows remote attackers to execute arbitrary code by sending specially crafted packets to the SMBv1 service. Known by its NSA exploit codename "EternalRomance," this vulnerability was part of the Shadow Brokers leak of NSA hacking tools and has been confirmed exploited by ransomware operators. Affected products include Microsoft SMB version 1.0 across Windows desktop and server editions, as well as embedded systems from Siemens. This CVE has a confirmed ransomware association in the CISA KEV catalog and was added on February 10, 2022, with a remediation deadline of August 10, 2022. The EPSS score of 93.27% (99.80th percentile) reflects widespread exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | server message block | 1.0 |
| siemens | acuson p300 firmware | 13.02; 13.03; 13.20; 13.21 |
| siemens | acuson p500 firmware | va10; vb10 |
| siemens | acuson sc2000 firmware | >= 4.0, < 4.0e; 5.0a |
| siemens | acuson x700 firmware | 1.0; 1.1 |
| siemens | syngo sc2000 firmware | >= 4.0, < 4.0e; 5.0a |
| siemens | tissue preparation system firmware | All versions |
| siemens | versant kpcr molecular system firmware | All versions |
| siemens | versant kpcr sample prep firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/96705(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037991(Broken Link, Third Party Advisory, VDB Entry)
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf(Third Party Advisory)
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02(Third Party Advisory, US Government Resource)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0145(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41891/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41987/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0145(US Government Resource)
Weakness Type
SMBv1 Remote Code Execution Weakness
CVE-2017-0145 does not have a formally assigned CWE, but the underlying weakness involves improper handling of SMBv1 transaction structures that leads to a buffer overflow condition. The vulnerability exists in how the Windows SMBv1 server processes certain types of transaction requests, failing to properly validate the size and content of incoming data structures.
SMBv1 (Server Message Block version 1) is a legacy network file sharing protocol dating back to the 1980s. Its age and complexity make it particularly prone to memory corruption vulnerabilities. The protocol was designed without modern security considerations, and its continued presence on Windows systems has provided a persistent attack surface. This vulnerability, along with related SMBv1 flaws, demonstrated the catastrophic risk of maintaining legacy protocol support in modern operating environments.
Impact Analysis
CVE-2017-0145 carries a CVSS 3.1 base score of 8.8 (HIGH) with devastating real-world impact through ransomware campaigns.
Confidentiality (High): Remote code execution via SMBv1 grants the attacker access to all data accessible by the SMB service, which typically runs with SYSTEM-level privileges. This includes all files on the machine, credentials cached in memory, and access to network resources available through the compromised system.
Integrity (High): With SYSTEM-level code execution, an attacker can modify any file on the system, install persistent backdoors, deploy ransomware, alter security configurations, and create new administrative accounts. The NotPetya attack demonstrated how SMBv1 exploits enable rapid, automated propagation and destructive payload deployment.
Availability (High): The most devastating real-world impact has been on availability. Ransomware campaigns exploiting SMBv1 vulnerabilities have caused billions of dollars in damages through encrypted systems, destroyed data, and prolonged operational outages affecting entire organizations.
Ransomware confirmed: CISA's KEV catalog explicitly confirms ransomware association. CVE-2017-0145, as part of the EternalRomance/EternalBlue family of exploits, has been incorporated into multiple ransomware frameworks.
The EPSS score of 93.27% (99.80th percentile) reflects the widespread automated exploitation of this vulnerability class.
Exploit Maturity
CVE-2017-0145 has an extremely high exploit maturity as part of the NSA exploit toolkit leaked by the Shadow Brokers.
NSA exploit tools: CVE-2017-0145 corresponds to the "EternalRomance" exploit from the NSA's Equation Group toolkit, leaked by the Shadow Brokers group in April 2017. Weaponized exploit code was made publicly available immediately.
Public exploits: Multiple exploit implementations exist on Exploit-DB (41891 and 41987) and Packet Storm Security, including the DOUBLEPULSAR payload injection framework used alongside the SMBv1 exploits.
Ransomware campaigns: This vulnerability, alongside the closely related CVE-2017-0144 (EternalBlue), was exploited in the WannaCry and NotPetya ransomware campaigns of 2017, causing an estimated $10+ billion in global damages. NotPetya specifically used EternalRomance as a propagation mechanism.
KEV listing with ransomware flag: CISA confirmed ransomware association and added this to the KEV catalog on February 10, 2022.
Continued exploitation: Despite patches being available since March 2017, SMBv1 vulnerabilities continue to be exploited due to legacy systems and unpatched environments.
EPSS context: The EPSS score of 93.27% (99.80th percentile) confirms ongoing widespread exploitation activity.
Remediation
-
Apply Microsoft security update MS17-010 immediately. Install the patch from the Microsoft Security Response Center for all affected Windows versions. Microsoft also released emergency patches for end-of-life systems including Windows XP.
-
Disable SMBv1 entirely. SMBv1 is a deprecated protocol with known systemic security issues. Disable it via PowerShell:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol. Verify that no business-critical applications depend on SMBv1 before disabling. -
Block SMB traffic at network boundaries. Use firewall rules to block TCP ports 445 and 139 at the network perimeter. SMB should never be exposed to the internet. Additionally, segment internal networks to limit lateral movement via SMB.
-
Audit for legacy systems and IoT devices. Siemens medical imaging devices and other embedded systems running affected Windows versions may not receive standard Windows updates. Identify and isolate these systems on dedicated network segments.
-
Scan for compromise indicators. Check for DOUBLEPULSAR backdoor implants, which are commonly deployed alongside EternalRomance exploitation. Use network scanning tools to detect SMBv1-specific backdoor signatures on port 445.
-
Implement network detection. Deploy IDS/IPS rules to detect EternalRomance exploitation attempts and DOUBLEPULSAR communications. Monitor for anomalous SMB traffic patterns indicating lateral movement.
Technical Details
CVE-2017-0145 is a remote code execution vulnerability in the Microsoft SMBv1 server, known by the NSA codename "EternalRomance." The vulnerability allows remote attackers to execute arbitrary code by sending crafted packets to the SMBv1 service on TCP port 445.
Attack vector and prerequisites: The attack is network-based (AV:N) with low complexity (AC:L). It requires low privileges (PR:L) — specifically, a valid SMB session — and no user interaction (UI:N). The attacker needs network access to the SMBv1 service.
Exploitation mechanism: The vulnerability exists in the SMBv1 transaction handling code. The exploit manipulates SMB_COM_TRANSACTION2 requests to trigger a type confusion or buffer overflow in the Windows kernel's SMB server driver (srv.sys). By carefully crafting the transaction structure, the attacker corrupts kernel memory in a controlled manner, enabling arbitrary code execution with SYSTEM privileges.
DOUBLEPULSAR integration: In the original NSA toolkit, EternalRomance was used in conjunction with DOUBLEPULSAR, a kernel-level backdoor implant injected via the SMB exploit. DOUBLEPULSAR provides persistent code execution capability, allowing the attacker to inject arbitrary DLLs into the target system.
Affected systems: Microsoft SMB 1.0 across Windows desktop (7, 8.1, 10) and server editions (2008, 2012, 2016), plus Siemens ACUSON medical imaging devices running embedded Windows.
Relationship to other SMBv1 CVEs: CVE-2017-0145 is part of a family of related SMBv1 vulnerabilities including CVE-2017-0144 (EternalBlue), all addressed by the MS17-010 security bulletin.
Frequently Asked Questions
What is CVE-2017-0145?
CVE-2017-0145, known as "EternalRomance," is a high-severity remote code execution vulnerability in the Microsoft SMBv1 server. It allows remote attackers to execute arbitrary code with SYSTEM privileges by sending crafted packets to TCP port 445. The exploit was developed by the NSA and leaked by the Shadow Brokers group in April 2017.
Is CVE-2017-0145 related to WannaCry and NotPetya?
Yes. CVE-2017-0145 is part of the same family of SMBv1 vulnerabilities exploited in the WannaCry and NotPetya ransomware campaigns of 2017. While WannaCry primarily used CVE-2017-0144 (EternalBlue), NotPetya incorporated both EternalBlue and EternalRomance for propagation, causing an estimated $10+ billion in global damages.
How do I fix CVE-2017-0145?
Apply Microsoft security bulletin MS17-010. More importantly, disable SMBv1 entirely on all systems where it is not absolutely required. Block SMB ports 445 and 139 at network boundaries, and segment internal networks to limit SMB-based lateral movement. Scan for DOUBLEPULSAR backdoor implants on potentially affected systems.
How severe is CVE-2017-0145?
CVE-2017-0145 is rated HIGH with a CVSS score of 8.8 and has confirmed ransomware association. The EPSS score of 93.27% places it in the 99.80th percentile. As part of the NSA exploit toolkit used in the most destructive ransomware campaigns in history, it represents one of the most consequential vulnerabilities ever disclosed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.