CISA adds bugs exploited by commercial surveillance spyware to Known Exploited Vulnerabilities catalog
60
CVE-2017-7494
KEV ransomwaremassUnauthenticated RCE in Samba via malicious shared library upload (SambaCry)
CISA: Samba Remote Code Execution Vulnerability
CVSS 3.1
9.8 critical
EPSS
99%p100
Published
()
KEV added
AI analysis
CVE-2017-7494, widely known as "SambaCry," is a remote code execution vulnerability (CWE-94, code injection) in Samba versions since 3.5.0, fixed in 4.6.4, 4.5.10, and 4.4.14. A malicious client with write access to a share uploads a shared library to a writable share and then causes the Samba server to load and execute it, giving the attacker code execution on the host with the privileges of the Samba service. Because Samba is bundled with most Linux distributions and with NAS and other embedded devices, both enterprise Linux servers and consumer/small-business NAS appliances are affected; Debian also ships affected Samba packages. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30) with known ransomware use, and public reporting ties it to the SambaCry, CowerSnail, ETERNALSILENCE, and SHELLBIND malware campaigns. EPSS assigns a 99.4% probability of exploitation within 30 days (100th percentile).
What to do: Upgrade Samba to 4.6.4 or later (4.6.x), 4.5.10 or later (4.5.x), or 4.4.14 or later (4.4.x/earlier), or install updated samba packages from your distribution (e.g., Debian) per vendor instructions, as required by the CISA KEV catalog. Until patched, remove or restrict write access on shares reachable by untrusted clients, and audit writable shares for unexpected shared-library (.so) files that may have been planted by attackers. Prioritize internet-facing Samba servers and NAS devices, given confirmed ransomware and IoT/NAS malware exploitation of this flaw.
Affected
| Samba | All releases from 3.5.0 onward prior to the fixes: versions before 4.6.4 on the 4.6.x branch, before 4.5.10 on the 4.5.x branch, and before 4.4.14 on the 4.4.x |
| Debian Linux | Debian releases shipping affected Samba packages as listed above (fixed via updated samba packages per vendor instructions) |
Estimated exposure
massOn the order of hundreds of thousands of internet-exposed Samba/SMB servers and NAS devices; millions of installations in total — Internet-wide scans around the time of disclosure counted hundreds of thousands of exposed SMB/Samba endpoints, and Samba is bundled by default in most Linux distributions and NAS/embedded firmware, implying installations well into the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
CISA Known Exploited Vulnerability
- Affected
- Samba Samba
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Known
In the news20 stories
60
60
60
60
60
60
60
60
60
60
60
60
60
60
47
47
47
Turn it off and on again, but for critical infrastructure
KTH researchers trained a reinforcement-learning intrusion response agent on an emulated segmented OT network that autonomously resets hosts and processes to disrupt intruders.
Researchers at KTH Royal Institute of Technology built a containerized replica of a segmented industrial network, attacked it across 14 days, and captured 40,000 30-second traffic intervals to train a defense agent under partial observability. The agent observes six packet-count numbers per interval, maintains 500 running state hypotheses, and can reset supervisory hosts, water tank processes, or entire subnets, with resets rebooting the target, renewing credentials, and changing its IP. The best agent approached a full-visibility baseline but depends on an assumed attacker behavior model; the testbed comprised three supervisory hosts, two PLCs, two tanks, weak credentials, and CVE-2017-7494 exposure. The team released its implementation and plans validation on a real industrial testbed with a partner.
42
35