Vulnerability record · CVE-2017-0146 · published 17 March 2017
CVE-2017-0146: Microsoft Windows SMBv1 remote code execution flaw
Microsoft · Server Message Block
The SMBv1 server in multiple Microsoft Windows versions mishandles crafted packets, allowing remote code execution. It is one of the SMB flaws exploited by EternalBlue/DoublePulsar and is listed in CISA KEV with known ransomware use, so unpatched SMBv1 exposure is a serious risk.
Description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and allows remote code execution on unpatched SMBv1 systems.
What it is
The SMBv1 server in multiple Microsoft Windows versions mishandles crafted packets, allowing remote code execution. It is one of the SMB flaws exploited by EternalBlue/DoublePulsar and is listed in CISA KEV with known ransomware use, so unpatched SMBv1 exposure is a serious risk.
Impact
An attacker who can reach the SMB service can execute arbitrary code with the privileges of the SMB service, typically SYSTEM, leading to full host compromise.
Attack surface
Reached over the network via SMB (port 445/139) by sending crafted packets; the CVSS vector indicates network access with low privileges required and no user interaction.
Exploitation
CISA KEV lists it as exploited in the wild with known ransomware campaign use, and EPSS is very high (0.89862, 99.8th percentile); multiple references are tagged Exploit.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for all affected Windows versions.
- Disable SMBv1 where it is not required and block SMB ports 445/139 at network boundaries.
- Apply vendor updates for affected Siemens and related product firmware listed in the record.
- Segment or isolate systems that must retain SMBv1, and restrict access to trusted hosts only.
Detection
- Monitor for SMBv1 traffic and anomalous SMB packet patterns on ports 445/139.
- Alert on known EternalBlue/DoublePulsar exploitation indicators and payload execution artifacts.
- Audit hosts for missing MS17-010-class patches and enabled SMBv1.
- Review logs for unexpected SYSTEM-level process creation or service crashes on SMB servers.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-0146 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "Microsoft Windows SMB Remote Code Execution Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 15 April 2022.
Affected products
9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
Server Message Block Microsoft
Acuson P300 Firmware Siemens
Acuson P500 Firmware Siemens
Acuson Sc2000 Firmware Siemens
Acuson X700 Firmware Siemens
Syngo Sc2000 Firmware Siemens
Tissue Preparation System Firmware Siemens
Versant Kpcr Molecular System Firmware Siemens
Versant Kpcr Sample Prep Firmware Siemens
References
Track CVE-2017-0146 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-0146), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
