CVE-2017-0147

Timeline

Detection, updates, and resolution for this record.

1. Mar 16, 2017 · Catalog

   Detected

   The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."

2. May 24, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jun 14, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."

Affected

• cpe microsoft/windows 10 1507version unspecified
• cpe microsoft/windows 10 1511version unspecified
• cpe microsoft/windows 10 1607version unspecified
• cpe microsoft/windows 7version unspecified
• cpe microsoft/windows 8.1version unspecified
• cpe microsoft/windows rt 8.1version unspecified
• cpe microsoft/windows server 2008version unspecified
• cpe microsoft/windows server 2008r2
• cpe siemens/acuson p300 firmware13.02
• cpe siemens/acuson p500 firmwareva10
• cpe siemens/acuson sc2000 firmwareversion unspecified
• cpe siemens/acuson x700 firmware1.0
• vendor Microsoft SMBv1 serverversion unspecified

Sources

• CISA KEVCVE-2017-0147

  The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.

  cisa.gov
• CVE.orgCVE-2017-0147

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2017-0147

  30-day exploitation probability 99.7%

  first.org
• Exploit Database41891

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Exploit Database47456

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit Modulesauxiliary_admin/smb/ms17_010_command

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• Metasploit Modulesauxiliary_scanner/smb/smb_ms17_010

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• Metasploit Modulesexploit_windows/smb/ms17_010_eternalblue

  Public module reference (average). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2017-0147

  The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information f

  nvd.nist.gov
• Packet Storm Securityhttp://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com
• Packet Storm Securityhttp://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• Exploit · packetstormsecurity.com
• Broken Link · securityfocus.com
• Broken Link · securitytracker.com
• Third Party Advisory · cert-portal.siemens.com
• Third Party Advisory · cert-portal.siemens.com
• CISA note · nvd.nist.gov
• Patch · portal.msrc.microsoft.com