Microsoft SMBv1
CVE-2017-0144
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconPort scan for TCP 445
-
DeliverySMBv1 protocol negotiation
-
ExploitSend EternalBlue exploit payload
-
InstallKernel memory corruption
-
C2Execute shellcode as SYSTEM
-
ExecuteInject DOUBLEPULSAR backdoor
-
ImpactDownload secondary payload
-
Step 8Achieve persistence and lateral movement
Vulnerability Assessment
| Exploitation Conditions | SMBv1 protocol must be enabled (default on Windows Vista through Windows 8.1; optional feature on Windows 10). TCP port 445 must be network-accessible to the attacker (internet-exposed or reachable within compromised network segment). CVSS vector indicates PR:L (low privileges required), meaning attacker needs valid SMB credentials - however, in practice, exploitation often succeeds against systems with guest account enabled, null session authentication permitted, or using default/weak SMB credentials common in 2017 enterprise environments. No user interaction required (UI:N). Exploitation is NOT limited to specific non-default configurations - any Windows system with SMBv1 enabled and port 445 reachable is vulnerable. The primary limiting factor is network accessibility: systems behind properly configured firewalls blocking inbound SMB traffic (TCP 445/139) from untrusted networks are protected at the network layer, though remain vulnerable to lateral movement if internal network is compromised. |
| Impact | This represents CRITICAL real-world risk with all adverse indicators aligned: CVSS 8.8 (High severity with network attack vector, low complexity, requiring only low privileges), EPSS 94.32% in 100th percentile (near-certain exploitation likelihood), confirmed active exploitation per CISA KEV listing, and multiple publicly available exploits. SSVC framework assessment: exploitation is active, attack is fully automatable (wormable), and technical impact is total system compromise. The contradiction between CVSS PR:L (low privileges required) and real-world weaponization is explained by credential stuffing and the fact that guest/anonymous SMB access was often enabled in 2017 enterprise environments. Unlike many high-CVSS vulnerabilities with theoretical risk, EternalBlue drove two of history's most destructive malware campaigns (WannaCry, NotPetya) causing billions in damages. Seven years post-disclosure, unpatched systems remain prevalent on legacy networks, medical devices, and air-gapped environments that missed the patching window, making this a persistent threat. The Siemens medical device impact (requiring vendor-specific patches beyond Microsoft's) extends remediation complexity in healthcare environments. |
| Exploit ScenarioDerived | Attacker scans internet ranges for exposed TCP port 445, identifies Windows systems advertising SMBv1 support via protocol negotiation. Using publicly available EternalBlue exploit code (Metasploit module, standalone Python scripts from Exploit-DB 41891/41987/42030/42031), attacker sends specially crafted SMB packets that overflow kernel memory in the SrvOs2FeaListToNt function. Successful exploitation grants SYSTEM-level code execution, allowing installation of DOUBLEPULSAR backdoor (a kernel-mode implant injected via exploit), which then downloads and executes ransomware payload (as in WannaCry) or wiper malware (as in NotPetya). The exploit is fully automated and wormable, enabling self-propagation across networks without further attacker interaction, as demonstrated by WannaCry's spread to 200,000+ systems in 150 countries within 72 hours in May 2017. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 22, 2026
Remote code execution in Microsoft SMBv1 allows authenticated network attackers to execute arbitrary code on Windows systems via crafted packets. This vulnerability (part of the MS17-010 bulletin and known as 'EternalBlue') is confirmed actively exploited (CISA KEV) with EPSS score of 94.32%, indicating near-certain exploitation probability. Widely weaponized in 2017 WannaCry and NotPetya ransomware campaigns. Affects Windows Vista through Windows 10 1607 and Windows Server 2008-2016, plus Siemens medical imaging systems running vulnerable Windows embedded OS. Multiple public exploits available including DOUBLEPULSAR payload delivery framework.
Earlier versions of this analysis (1)
The SMBv1 server in Windows contains a buffer overflow that allows unauthenticated remote code execution. Known as 'EternalBlue' (developed by NSA's Equation Group), it was leaked by the Shadow Brokers in April 2017 and used in the WannaCry and NotPetya global cyberattacks.
RemediationAI
Apply Microsoft Security Bulletin MS17-010 patches immediately via Windows Update or from the Microsoft Security Update Guide at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144 (patches released March 2017 for all supported Windows versions; extended patches later released for unsupported Windows XP/Server 2003 due to WannaCry). For Siemens medical devices, contact Siemens Healthcare support for device-specific patches per ICS-CERT advisory ICSMA-18-058-02, as standard Windows patches may break medical device certifications. If immediate patching is impossible, disable SMBv1 protocol via PowerShell command 'Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol' on Windows 8.1+ or registry modification on older versions (note: disabling SMBv1 breaks compatibility with Windows XP clients, legacy network attached storage, and some multifunction printers). Block TCP ports 445 and 139 at network perimeter and segment internal networks to prevent lateral wormable spread (critical for containing potential ransomware outbreaks, though this does not prevent initial compromise of edge systems). For air-gapped or isolated medical/industrial networks, physically verify patch deployment as these environments often lack centralized patch management visibility.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits a buffer overflow in the SMBv1 (Server Message Block version 1) protocol implementation, specifically in the SrvOs2FeaListToNt function. SMBv1 is a legacy network file sharing protocol enabled by default on older Windows systems for interoperability with legacy devices and shares. The flaw allows specially crafted SMB packets to overflow kernel memory, enabling arbitrary code execution in kernel context (SYSTEM privileges). CPE data confirms impact extends beyond Microsoft Windows to include Siemens Acuson ultrasound systems (P300, P500, SC2000, X700 models) running Windows-based embedded firmware versions 5.0a through va10/vb10, as these medical devices rely on vulnerable Windows OS components. The vulnerability was allegedly discovered and stockpiled by the NSA (disclosed in the Shadow Brokers leak) before being patched by Microsoft in MS17-010. While no specific CWE is assigned, the root cause aligns with CWE-787 (Out-of-bounds Write) in network protocol parsing.
Know when Server Message Block gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Executive ViewAI
CVE-2017-0144 (EternalBlue) is a critical remote code execution vulnerability in Microsoft SMB that enables attackers to deploy ransomware and establish persistent system access on Windows endpoints and servers. With confirmed active exploitation (CISA KEV), an EPSS score of 94.3%, and publicly available weaponized exploits, unpatched systems face near-certain compromise risk-particularly those running Windows 7, Server 2008-2016, or embedded systems in OT/medical environments. Organizations lacking complete patch deployment remain vulnerable to the same attack vectors that drove the 2017 WannaCry pandemic.
Apply vendor patch. If immediate patching is unavailable: (1) Disable SMBv1 protocol entirely via Group Policy or registry; (2) Block inbound TCP/UDP port 445 at perimeter firewalls and network segmentation boundaries; (3) Restrict SMB access to trusted internal subnets only; (4) Deploy host-based IDS/IPS rules detecting EternalBlue exploitation patterns (MS17-010 shellcode signatures); (5) Isolate unpatched systems from production networks pending emergency maintenance windows.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
More in Server Message Block
View allThe SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
GitHub PoC