CVE-2017-0148
Microsoft SMBv1 Server Remote Code Execution Vulnerability
Published Mar 16, 2017 · updated Jun 16, 2026 · microsoft server message block
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
Timeline
Detection, updates, and resolution for this record.
Mar 16, 2017 · Catalog
Detected
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those describe
Apr 6, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 27, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those describe
Required action
Apply updates per vendor instructions.
CISA due date Apr 27, 2022
Affected
- cpe microsoft/server message block1.0
- cpe siemens/acuson p300 firmware13.02
- cpe siemens/acuson p300 firmware13.03
- cpe siemens/acuson p300 firmware13.20
- cpe siemens/acuson p300 firmware13.21
- cpe siemens/acuson p500 firmwareva10
- cpe siemens/acuson p500 firmwarevb10
- cpe siemens/acuson sc2000 firmwareversion unspecified
- cpe siemens/acuson x700 firmware1.0
- cpe siemens/syngo sc2000 firmwareversion unspecified
- cpe siemens/tissue preparation system firmwareversion unspecified
- cpe siemens/versant kpcr molecular system firmwareversion unspecified
- vendor Microsoft SMBv1 serverversion unspecified
Sources
- CISA KEVCVE-2017-0148
The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.
cisa.gov - CVE.orgCVE-2017-0148
Official CVE identifier
cve.org - FIRST EPSSCVE-2017-0148
30-day exploitation probability 99.4%
first.org - Exploit Database41891
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database47456
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesauxiliary_scanner/smb/smb_ms17_010
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - Metasploit Modulesexploit_windows/smb/ms17_010_eternalblue
Public module reference (average). Module source is not copied into this catalog.
rapid7.com - Metasploit Modulesexploit_windows/smb/smb_doublepulsar_rce
Public module reference (great). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2017-0148
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via cra
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com