CVE-2017-0146
Microsoft Windows SMB Remote Code Execution Vulnerability
Description
CVE-2017-0146 is a high-severity vulnerability affecting Microsoft Windows. The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution. An attacker can exploit this flaw with low privileges over the network. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.29% (99.8th percentile) indicates a significantly elevated exploitation probability. This vulnerability is known to have been used in ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | server message block | 1.0 |
| siemens | acuson p300 firmware | 13.02; 13.03; 13.20; 13.21 |
| siemens | acuson p500 firmware | va10; vb10 |
| siemens | acuson sc2000 firmware | >= 4.0, <= 4.0e; 5.0a |
| siemens | acuson x700 firmware | 1.0; 1.1 |
| siemens | syngo sc2000 firmware | >= 4.0, <= 4.0e; 5.0a |
| siemens | tissue preparation system firmware | All versions |
| siemens | versant kpcr molecular system firmware | All versions |
| siemens | versant kpcr sample prep firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/96707(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037991(Broken Link, Third Party Advisory, VDB Entry)
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf(Third Party Advisory)
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02(Third Party Advisory, US Government Resource)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0146(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41891/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41987/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/43970/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0146(US Government Resource)
Weakness Type
Unspecified Weakness
No specific CWE classification has been assigned to this vulnerability. The underlying weakness enables remote exploitation of Microsoft Windows, potentially leading to unauthorized access or code execution.
Learn more: CWE Database
Impact Analysis
CVE-2017-0146 carries a CVSS 3.1 base score of 8.8 (HIGH), reflecting the serious risk it poses to affected environments. Successful exploitation can lead to complete compromise of data confidentiality, full system integrity compromise, and complete denial of service. The attack vector is network-based with low complexity, meaning exploitation is straightforward and can be reliably repeated. Organizations running Microsoft Windows face tangible risk of unauthorized access, data breaches, and operational disruption if this vulnerability remains unpatched.
Exploit Maturity
CVE-2017-0146 is listed in the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-04-15, confirming that real-world exploitation has been observed. The EPSS score of 93.29% (99.8th percentile) places this vulnerability among those most likely to be exploited. Public exploit code is available in vulnerability databases, lowering the barrier for attackers and increasing the urgency of remediation. This vulnerability has been associated with ransomware campaigns, highlighting its use by financially motivated threat actors.
Remediation
- Apply updates per vendor instructions. This is the CISA-mandated remediation action and should be prioritized immediately.
- If patches cannot be applied immediately, restrict network access to the affected Windows management interfaces to only trusted administrative networks using firewall rules or access control lists.
- Monitor vendor security advisories for additional updates and ensure a patch management process is in place for timely deployment.
- Conduct a thorough review of affected systems for signs of prior compromise, including unexpected user accounts, modified configurations, and unusual network activity.
- Implement defense-in-depth measures including network segmentation, intrusion detection systems, and continuous security monitoring for the affected infrastructure.
Technical Details
CVE-2017-0146 is exploitable remotely over the network with low-level user credentials. The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution. The attack complexity is rated low, meaning no specialized conditions or preparation are needed beyond network access to the target. The scope is unchanged, meaning the impact is confined to the vulnerable component. The CVSS 3.1 base score of 8.8 reflects the combination of these factors and the potential for significant damage to affected systems.
Frequently Asked Questions
Is CVE-2017-0146 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2017-0146 to the Known Exploited Vulnerabilities catalog. The EPSS score of 93.29% (99.8th percentile) further indicates high exploitation likelihood. This vulnerability has also been linked to ransomware campaigns.
What products are affected by CVE-2017-0146?
CVE-2017-0146 affects Microsoft Windows. Specifically, affected products include microsoft server message block, siemens acuson p300 firmware, siemens acuson p500 firmware, siemens acuson sc2000 firmware, siemens acuson x700 firmware, and others.
How do I fix CVE-2017-0146?
Apply updates per vendor instructions. Ensure your systems are updated to the latest patched version. If immediate patching is not feasible, restrict network access to the affected system's management interfaces.
How severe is CVE-2017-0146?
CVE-2017-0146 has a CVSS 3.1 score of 8.8 (HIGH). This is a high-severity vulnerability that poses significant risk and requires prompt remediation. The vulnerability enables authenticated remote attackers to potentially compromise affected Windows systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.