Vulnerability record · CVE-2017-0004 · published 10 January 2017
CVE-2017-0004: Windows LSASS improper input validation allows remote reboot
Microsoft · Windows 7
The Local Security Authority Subsystem Service (LSASS) in Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, and Windows 7 SP1 fails to properly validate a crafted authentication request, causing a denial of service that reboots the system. Because LSASS is a core authentication component, a single malformed request can take down the host without any credentials.
Description
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to cause a denial of service (reboot) via a crafted authentication request, aka "Local Security Authority Subsystem Service Denial of Service Vulnerability."
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated remote denial of service with a 7.5 CVSS score and very high EPSS, though limited to legacy Windows versions and with no confirmed in-the-wild exploitation in the record.
What it is
The Local Security Authority Subsystem Service (LSASS) in Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, and Windows 7 SP1 fails to properly validate a crafted authentication request, causing a denial of service that reboots the system. Because LSASS is a core authentication component, a single malformed request can take down the host without any credentials.
Impact
An unauthenticated remote attacker can force the affected Windows host to reboot, disrupting availability and any services or sessions it hosts. There is no confidentiality or integrity impact; the effect is purely denial of service.
Attack surface
Reachable over the network via the authentication interface that LSASS handles, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is very high (0.91372, 99.8th percentile), indicating strong predicted likelihood of exploitation activity.
What to do
- Apply Microsoft security bulletin MS17-004 (the vendor fix for this LSASS flaw) to all affected Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, and Windows 7 SP1 systems.
- Where these end-of-life platforms cannot be patched, isolate them on segmented networks and restrict inbound authentication traffic to trusted hosts only.
- Block or tightly filter the authentication ports/protocols LSASS exposes at network boundaries and between trust zones.
- Monitor for unexpected reboots of affected hosts and treat clustered reboot events as a possible attack indicator.
- Prioritize migration off Vista, Server 2008, and Windows 7, which no longer receive routine security updates.
Detection
- Alert on unexpected system reboots or shutdown events (e.g., Windows event log shutdown/startup records) on affected OS versions.
- Correlate LSASS crash or fault events with inbound authentication traffic from unusual or external source addresses.
- Baseline and monitor authentication request rates to affected hosts for anomalous spikes or malformed request patterns.
- Track network connections to LSASS-related authentication services from untrusted segments.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-0004 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-0004), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
