CVE-2017-0147: Microsoft Windows SMBv1 Server Information Disclosure via Crafted Packets

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use and has an EPSS probability near 1.0, and the affected SMBv1 service is widely deployed and remotely reachable without authentication.

What it is

The SMBv1 server in multiple Microsoft Windows versions fails to properly handle crafted packets, allowing remote attackers to read sensitive data from process memory. This is the information disclosure component of the SMBv1 flaws exploited by EternalBlue/DoublePulsar, and it matters because it leaks memory contents that can aid further attacks and because the affected protocol is still present on many unpatched and legacy systems.

Impact

An unauthenticated remote attacker can obtain sensitive information from process memory, potentially exposing credentials, cryptographic material, or memory layout details useful for follow-on exploitation. The flaw itself does not grant code execution or data modification.

Attack surface

Reachable over the network via the SMBv1 service, typically TCP port 445, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any host exposing SMBv1 is in scope.

Exploitation

CVE-2017-0147 is listed in CISA KEV with known ransomware campaign use, and EPSS shows a 30-day probability of 0.99693 (99.95th percentile); multiple public exploit references exist, including DoublePulsar payload material.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for all affected Windows versions.
• Disable SMBv1 on all hosts and servers where it is not strictly required.
• Block inbound SMB (TCP 445) from untrusted networks at the perimeter and between network segments.
• For Siemens and other affected third-party products, apply the vendor advisories (SSA-701903, SSA-966341, ICSMA-18-058-02).
• Retire or isolate unsupported legacy systems that cannot be patched.

Detection

• Monitor for SMBv1 negotiation and anomalous SMB traffic on TCP 445, especially from unexpected external or cross-segment sources.
• Alert on known exploit tooling signatures and DoublePulsar-related artifacts referenced in public exploit write-ups.
• Audit hosts for SMBv1 enabled status and track remediation of unpatched systems.
• Correlate SMB connection events with subsequent suspicious process or service activity on the target host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.