CVE-2017-0144

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 99.23%
EPSS Percentile: 99.94%
CISA KEV: YES — Known Exploited Vulnerability

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 17-Mar-2017 07:59
Last Modified: 14-Aug-2026 12:16
EPSS Date: 2026-10-16

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2022-02-10
Remediation Due: 2022-08-10
Known Ransomware Campaign Use: Known
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-0144

Affected Products / Versions

microsoft / server_message_block
Version / affected range: 1.0
cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*
siemens / acuson_p300_firmware
Version / affected range: 13.02
cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*
siemens / acuson_p300_firmware
Version / affected range: 13.03
cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*
siemens / acuson_p300_firmware
Version / affected range: 13.20
cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*
siemens / acuson_p300_firmware
Version / affected range: 13.21
cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*
siemens / acuson_p500_firmware
Version / affected range: va10
cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*
siemens / acuson_p500_firmware
Version / affected range: vb10
cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*
siemens / acuson_sc2000_firmware
Version / affected range: * · from (inclusive) 4.0 · before (exclusive) 4.0e
cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*
siemens / acuson_sc2000_firmware
Version / affected range: 5.0a
cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*
siemens / acuson_x700_firmware
Version / affected range: 1.0
cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*
siemens / acuson_x700_firmware
Version / affected range: 1.1
cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*
siemens / syngo_sc2000_firmware
Version / affected range: * · from (inclusive) 4.0 · before (exclusive) 4.0e
cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*
siemens / syngo_sc2000_firmware
Version / affected range: 5.0a
cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*
siemens / tissue_preparation_system_firmware
Version / affected range: *
cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*
siemens / versant_kpcr_molecular_system_firmware
Version / affected range: *
cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*
siemens / versant_kpcr_sample_prep_firmware
Version / affected range: *
cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*

References

Last enrichment sync: 18-Oct-2026 08:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

This exploit was based on a Microsoft zero-day flaw (CVE-2017-0144) and was also used in the WannaCry attack the month prior. Huntress Looks Back at 10 Cybersecurity Events That Shaped the Past Decade

CVE (9)

Malware (5)

Threat Actors (3)

MITRE ATT&CK (6)

Vendors (6)

Products (5)

Tools (1)

Industries (3)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.