Microsoft says it has fixed exploits leaked by Shadow Brokers in March

CVE-2017-0146 is a remote code execution flaw in the Microsoft Windows SMBv1 server that is triggered when the vulnerable service processes specially crafted SMB packets, one of a family of related SMBv1 bugs (CVE-2017-0143/0144/0145/0148) publicly leaked by the Shadow Brokers and fixed by Microsoft in the MS17-010 April 2017 bulletin. An attacker with limited privileges who can reach the SMB service over the network can execute arbitrary code in kernel context, gaining a foothold for lateral movement and follow-on payloads such as ransomware or cryptocurrency miners. Affected systems span Windows Vista SP2 through Windows Server 2016, as well as Siemens medical and laboratory products (Acuson ultrasound, syngo, Versant kPCR systems) that run on affected Windows platforms. Public exploit code exists, including Metasploit ports of the NSA EternalRomance/EternalSynergy/EternalChampion exploits, and the vulnerability is in CISA's Known Exploited Vulnerabilities catalog with documented ransomware use. Exploitation probability is extremely high (EPSS 89.9%, top percentile), so unpatched systems remain at immediate risk.

Do: Apply Microsoft's MS17-010 (April 2017) security updates on all affected Windows versions, and apply Siemens' published firmware/security updates for Acuson, syngo, Tissue Preparation System, and Versant kPCR products. As an interim mitigation, disable SMBv1 where possible and restrict inbound access to TCP/445; check hosts for signs of compromise such as the DOUBLEPULSAR implant. This CVE is in CISA's KEV catalog with known ransomware use, so prioritize internet-facing and clinical/network-segmented but unpatched systems immediately.

CVE-2017-0147 is an information disclosure flaw in the SMBv1 server component of Windows: an unauthenticated remote attacker sends specially crafted SMBv1 packets that cause the server to leak sensitive contents of process memory. It belongs to the SMBv1 'Eternal' family of flaws patched in Microsoft's March 2017 MS17-010 bulletin, whose exploit tooling later surfaced in the Shadow Brokers leak and is associated with DOUBLEPULSAR implant activity on TCP 445. The attacker gains read access to process memory (confidentiality-only impact reflected in the CVSS 7.5 score), which can expose sensitive data or assist follow-on attacks, though this CVE alone does not grant code execution. Anyone running the affected Windows releases with the SMBv1 server enabled is exposed, including legacy desktops and servers and Siemens ACUSON P300/P500 ultrasound systems, particularly hosts with TCP 445 reachable from untrusted networks. Exploitation is in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-24 with known ransomware use, and EPSS assigns a ~99.7% probability of exploitation activity in any 30-day window.

Do: Apply Microsoft's MS17-010 security update (March 2017) or later cumulative updates on every affected Windows host, per the vendor's instructions, and update Siemens ACUSON P300/P500 firmware per Siemens' guidance. Where patching is impractical, disable SMBv1 (e.g., via Group Policy or Set-SmbServerConfiguration -EnableSMB1Protocol $false) and restrict inbound TCP 445 to trusted networks only. Audit exposed and legacy hosts for DOUBLEPULSAR-style SMB implants and unnecessary SMBv1 exposure.