ZeroDay Findings
Sign inSign up

Findings

CVE-2017-0143

Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability

Published Mar 16, 2017 · updated Jun 16, 2026 · microsoft server message block

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 16, 2017 · Catalog

    Detected

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those describe

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those describe

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe microsoft/server message block1.0
  • cpe philips/intellispace portal7.0
  • cpe philips/intellispace portal8.0
  • cpe siemens/acuson p300 firmware13.02
  • cpe siemens/acuson p300 firmware13.03
  • cpe siemens/acuson p300 firmware13.20
  • cpe siemens/acuson p300 firmware13.21
  • cpe siemens/acuson p500 firmwareva10
  • cpe siemens/acuson sc2000 firmwareversion unspecified
  • cpe siemens/acuson x700 firmware1.0
  • cpe siemens/syngo sc2000 firmwareversion unspecified
  • cpe siemens/tissue preparation system firmwareversion unspecified
  • vendor Microsoft Windowsversion unspecified

Sources

  • CISA KEVCVE-2017-0143

    Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.

    cisa.gov
  • CVE.orgCVE-2017-0143

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-0143

    30-day exploitation probability 93.3%

    first.org
  • Exploit Database41891

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database47456

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesauxiliary_admin/smb/ms17_010_command

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesauxiliary_scanner/smb/smb_ms17_010

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_windows/smb/ms17_010_eternalblue

    Public module reference (average). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2017-0143

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via cra

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References