Actively exploited — CISA Known Exploited Vulnerabilities (KEV) Catalog

CISA has confirmed this vulnerability is being exploited in the wild as of February 10, 2022. Recommended action: Apply updates per vendor instructions.

Federal remediation deadline (BOD 22-01): August 10, 2022 — a useful urgency reference even outside federal agencies.

⚠ Known to be used in ransomware campaigns

CVE-2017-0144

High8.8

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Published

March 17, 2017

Last modified

August 14, 2026

CVSS v3

8.8 / 10

CVSS v2

9.3 / 10

EPSS

99.23%

100th percentile

99.23% probability of exploitation in the next 30 days, per FIRST.org's EPSS model — higher than 100% of all scored CVEs.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type

NVD-CWE-noinfo

Affected Products

cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*
cpe:2.3:h:siemens:acuson_p300:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*
cpe:2.3:h:siemens:acuson_p500:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*
cpe:2.3:h:siemens:acuson_sc2000:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*
cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*
cpe:2.3:h:siemens:acuson_x700:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*
cpe:2.3:h:siemens:syngo_sc2000:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:tissue_preparation_system:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:versant_kpcr_molecular_system:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:versant_kpcr_sample_prep:-:*:*:*:*:*:*:*

References

Data sourced from the National Vulnerability Database, CISA KEV Catalog, and FIRST.org EPSS. View on NVD →