CVE-2017-0148

CVE-2017-0148 is a remote code execution flaw in the SMBv1 server implementation of Microsoft Windows, where improperly handled crafted SMB packets sent to an affected machine allow an attacker to execute arbitrary code without authentication. It is one of the MS17-010 'EternalBlue-family' SMBv1 bugs (distinct from but patched alongside CVE-2017-0143 through CVE-2017-0146) and is triggered by sending maliciously crafted packets to the SMBv1 service, typically reachable over the network on port 445. Successful exploitation gives an attacker the ability to run arbitrary code on the target host, enabling full system compromise, lateral movement, and, as recorded in CISA's Known Exploited Vulnerabilities catalog, ransomware deployment. All unpatched Windows releases from Windows Vista SP2 and Server 2008 through Windows 10 1607 and Server 2016 are affected by default, and Siemens also disclosed that its Acuson ultrasound systems, syngo SC2000, Tissue Preparation System, and Versant kPCR molecular diagnostics products embed the affected Microsoft SMB implementation. Exploitation is confirmed in the wild: the issue is in CISA KEV (added 2022-04-06, ransomware use known), EPSS puts 30-day exploitation probability at 99.4%, and multiple public PoC/exploit references exist, including DoublePulsar payload-execution tooling and Exploit-DB entries.

What to do: Apply the Microsoft MS17-010 (March 2017) security updates, or later cumulative updates, on all affected Windows Vista SP2 through Server 2016 systems; out-of-support platforms require the special Microsoft patches released for them. Disable SMBv1 where no longer needed and block inbound SMB (TCP 445) at the network perimeter except where required. Audit for unpatched internet-facing Windows hosts and for Siemens Acuson/syngo/Tissue Preparation System/Versant kPCR devices, applying Siemens firmware and configuration updates issued in response to Microsoft's MS17-010 advisories.