ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2017-0148

Microsoft SMBv1 Server Remote Code Execution Vulnerability

Published Mar 16, 2017 · catalog updated Jun 16, 2026 · Microsoft SMBv1

Patch now

CVE-2017-0148 is in the CISA known-exploited catalog, due Apr 27, 2022. Confirm Microsoft SMBv1 against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity
High8.1
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
99.36%
Remediation
Remediation guidance
Affected products
cpe microsoft/server message block · cpe siemens/acuson p300 firmware · cpe siemens/acuson p500 firmware · cpe siemens/acuson sc2000 firmware · cpe siemens/acuson x700 firmware · cpe siemens/syngo sc2000 firmware

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe microsoft/server message block1.0
  • cpe siemens/acuson p300 firmware13.02
  • cpe siemens/acuson p300 firmware13.03
  • cpe siemens/acuson p300 firmware13.20
  • cpe siemens/acuson p300 firmware13.21
  • cpe siemens/acuson p500 firmwareva10
  • cpe siemens/acuson p500 firmwarevb10
  • cpe siemens/acuson sc2000 firmwareversion unspecified
  • cpe siemens/acuson x700 firmware1.0
  • cpe siemens/syngo sc2000 firmwareversion unspecified
  • cpe siemens/tissue preparation system firmwareversion unspecified
  • cpe siemens/versant kpcr molecular system firmwareversion unspecified
  • vendor Microsoft SMBv1version unspecified
  • vendor Microsoft SMBv1 serverversion unspecified

How to fix CVE-2017-0148

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2017-0148 is in the CISA known-exploited catalog, due Apr 27, 2022. Confirm Microsoft SMBv1 against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with microsoft/server message block 1.0; siemens/acuson p300 firmware 13.02; siemens/acuson p300 firmware 13.03; siemens/acuson p300 firmware 13.20. Apply updates per vendor instructions.

What should an analyst verify?

CWE-20: Improper Input Validation. EPSS 99.36%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 16, 2017 · Catalog

    Detected

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those describe

  2. Apr 6, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 27, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those describe

Sources

  • CISA KEVConfirmed exploitationCVE-2017-0148

    The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2017-0148

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2017-0148

    30-day exploitation probability 99.4%

    first.org
  • Exploit DatabasePublic exploit reference41891

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference47456

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleauxiliary_scanner/smb/smb_ms17_010

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit ModulesPublic exploit moduleexploit_windows/smb/ms17_010_eternalblue

    Public module reference (average). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit ModulesPublic exploit moduleexploit_windows/smb/smb_doublepulsar_rce

    Public module reference (great). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2017-0148

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via cra

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • VulnCheck KEVConfirmed exploitationCVE-2017-0148

    The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.