Remote Code Execution Vulnerability in Microsoft Windows SMBv1
CVE-2017-0144

8.8HIGH

Key Information:

Vendor: Microsoft
Status: Windows Smb
Vendor: CVE Published:; 17 March 2017

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 94%🦅 CISA Reported

Summary

The SMBv1 protocol in various Microsoft Windows operating systems contains a vulnerability that enables remote attackers to execute arbitrary code by sending specially crafted packets to the server. This issue affects multiple versions of Windows, including desktop and server editions, allowing exploitation that could lead to severe security breaches. Users are strongly encouraged to disable SMBv1 or apply the necessary security patches to mitigate risks associated with this vulnerability.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Windows SMB The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2017-0144 - Proof of Concept

eternal_scanner
Created by peterpt