CVE-2017-0147
HIGHCVSS 7.5/10Actively ExploitedEPSS 99.69%
Last modified
CVE-2017-0147 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability.". CISA has confirmed active exploitation in the wild. EPSS estimates a 99.69% chance of exploitation in the next 30 days.
Description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Windows 10 1507 | All versions | — |
| Microsoft | Windows 10 1511 | All versions | — |
| Microsoft | Windows 10 1607 | All versions | — |
| Microsoft | Windows 7 | All versions | Sp1 |
| Microsoft | Windows 8.1 | All versions | — |
| Microsoft | Windows Rt 8.1 | All versions | — |
| Microsoft | Windows Server 2008 | All versions | Sp2 |
| Microsoft | Windows Server 2008 | r2 | Sp1 |
| Microsoft | Windows Server 2012 | All versions | — |
| Microsoft | Windows Server 2012 | r2 | — |
| Microsoft | Windows Server 2016 | All versions | — |
| Microsoft | Windows Vista | All versions | Sp2 |
| Siemens | Acuson P300 Firmware | 13.02 | — |
| Siemens | Acuson P300 Firmware | 13.03 | — |
| Siemens | Acuson P300 Firmware | 13.20 | — |
| Siemens | Acuson P300 Firmware | 13.21 | — |
| Siemens | Acuson P500 Firmware | va10 | — |
| Siemens | Acuson P500 Firmware | vb10 | — |
| Siemens | Acuson Sc2000 Firmware | >= 4.0, < 4.0e | — |
| Siemens | Acuson Sc2000 Firmware | 5.0a | — |
| Siemens | Acuson X700 Firmware | 1.0 | — |
| Siemens | Acuson X700 Firmware | 1.1 | — |
| Siemens | Syngo Sc2000 Firmware | >= 4.0, < 4.0e | — |
| Siemens | Syngo Sc2000 Firmware | 5.0a | — |
| Siemens | Tissue Preparation System Firmware | All versions | — |
| Siemens | Versant Kpcr Molecular System Firmware | All versions | — |
| Siemens | Versant Kpcr Sample Prep Firmware | All versions | — |
References
- https://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.htmlExploit, Third Party Advisory, VDB Entry
- https://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/96709Broken Link, Third Party Advisory, VDB Entry
- https://www.securitytracker.com/id/1037991Broken Link, Third Party Advisory, VDB Entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdfThird Party Advisory
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02Third Party Advisory, US Government Resource
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0147Patch, Vendor Advisory
- https://www.exploit-db.com/exploits/41891/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/41987/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/43970/Exploit, Third Party Advisory, VDB Entry
- https://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.htmlExploit, Third Party Advisory, VDB Entry
- https://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/96709Broken Link, Third Party Advisory, VDB Entry
- https://www.securitytracker.com/id/1037991Broken Link, Third Party Advisory, VDB Entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdfThird Party Advisory
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02Third Party Advisory, US Government Resource
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0147Patch, Vendor Advisory
- https://www.exploit-db.com/exploits/41891/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/41987/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/43970/Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0147US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2017-0147?
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."
How severe is CVE-2017-0147?
CVE-2017-0147 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 99.69% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2017-0147?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-0140Microsoft Edge allows remote attackers to bypass the Same Or…
- CVE-2017-0141A remote code execution vulnerability exists in the way affe…
- CVE-2017-0143The SMBv1 server in Microsoft Windows Vista SP2; Windows Ser…8.8
- CVE-2017-0144The SMBv1 server in Microsoft Windows Vista SP2; Windows Ser…8.8
- CVE-2017-0145The SMBv1 server in Microsoft Windows Vista SP2; Windows Ser…8.8
- CVE-2017-0146The SMBv1 server in Microsoft Windows Vista SP2; Windows Ser…8.8
- CVE-2017-0148The SMBv1 server in Microsoft Windows Vista SP2; Windows Ser…8.1
- CVE-2017-0149Microsoft Internet Explorer 9 through 11 allow remote attack…8.8
- CVE-2017-0150A remote code execution vulnerability exists in the way affe…
- CVE-2017-0151A remote code execution vulnerability exists in the way affe…
- CVE-2017-0152A remote code execution vulnerability exists in the way affe…
- CVE-2017-0154Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606…
Are you affected by CVE-2017-0147?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST