CVE-2017-0146

CVE-2017-0146 is a remote code execution flaw in the Microsoft Windows SMBv1 server that is triggered when the vulnerable service processes specially crafted SMB packets, one of a family of related SMBv1 bugs (CVE-2017-0143/0144/0145/0148) publicly leaked by the Shadow Brokers and fixed by Microsoft in the MS17-010 April 2017 bulletin. An attacker with limited privileges who can reach the SMB service over the network can execute arbitrary code in kernel context, gaining a foothold for lateral movement and follow-on payloads such as ransomware or cryptocurrency miners. Affected systems span Windows Vista SP2 through Windows Server 2016, as well as Siemens medical and laboratory products (Acuson ultrasound, syngo, Versant kPCR systems) that run on affected Windows platforms. Public exploit code exists, including Metasploit ports of the NSA EternalRomance/EternalSynergy/EternalChampion exploits, and the vulnerability is in CISA's Known Exploited Vulnerabilities catalog with documented ransomware use. Exploitation probability is extremely high (EPSS 89.9%, top percentile), so unpatched systems remain at immediate risk.

What to do: Apply Microsoft's MS17-010 (April 2017) security updates on all affected Windows versions, and apply Siemens' published firmware/security updates for Acuson, syngo, Tissue Preparation System, and Versant kPCR products. As an interim mitigation, disable SMBv1 where possible and restrict inbound access to TCP/445; check hosts for signs of compromise such as the DOUBLEPULSAR implant. This CVE is in CISA's KEV catalog with known ransomware use, so prioritize internet-facing and clinical/network-segmented but unpatched systems immediately.