Microsoft SMBv1 CVE-2017-0144

Apply Microsoft Security Bulletin MS17-010 patches immediately via Windows Update or from the Microsoft Security Update Guide at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144 (patches released March 2017 for all supported Windows versions; extended patches later released for unsupported Windows XP/Server 2003 due to WannaCry). For Siemens medical devices, contact Siemens Healthcare support for device-specific patches per ICS-CERT advisory ICSMA-18-058-02, as standard Windows patches may break medical device certifications. If immediate patching is impossible, disable SMBv1 protocol via PowerShell command 'Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol' on Windows 8.1+ or registry modification on older versions (note: disabling SMBv1 breaks compatibility with Windows XP clients, legacy network attached storage, and some multifunction printers). Block TCP ports 445 and 139 at network perimeter and segment internal networks to prevent lateral wormable spread (critical for containing potential ransomware outbreaks, though this does not prevent initial compromise of edge systems). For air-gapped or isolated medical/industrial networks, physically verify patch deployment as these environments often lack centralized patch management visibility.