Ransomware.live 👀

Known ransomware campaign use. CISA's KEV catalog lists this CVE as used in ransomware attacks.

CISA KEV

Exploited

Ransomware Use

CVSS 3.1 Score

8.8

HIGH

EPSS Score

99.23%

EPSS Percentile

99.9%

as of 2026-10-05

NVD Status

Analyzed

Published 2017-03-17

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Affected Vendors / Products

Microsoft	Server Message Block
Siemens	Acuson P300 Firmware
Siemens	Acuson P500 Firmware
Siemens	Acuson Sc2000 Firmware
Siemens	Acuson X700 Firmware
Siemens	Syngo Sc2000 Firmware
Siemens	Tissue Preparation System Firmware
Siemens	Versant Kpcr Molecular System Firmware
Siemens	Versant Kpcr Sample Prep Firmware

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness (CWE)

NVD-CWE-noinfo

Last Modified

2026-08-14

CVSS 3.1 Vector Breakdown

CISA Vulnrichment (SSVC)

Exploitation: active Automatable: no Technical Impact: total

Source: vulnerability-lookup.org

Exploitation Intelligence (3 sources)

Source	Exploited	Ransomware Use	Notes
enisa-cnw-kev	Yes	—	Affected: Microsoft / Windows (SMBv1 - EternalBlue) \| Exploitation type: ransomware \| Origin source: cnw
cisa-kev	Yes	Known	KEV entry: Microsoft SMBv1 Remote Code Execution Vulnerability \| Affected: Microsoft / SMBv1 \| Description: The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. \| Required action: Apply updates per vendor instructions. \| Due date: 2022-08-10 \| Known ransomware campaign use (KEV): Known \| Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0144
kevintel	Yes	Known	KEVIntel entry: The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2;... \| Affected: Microsoft Corporation / Windows SMB \| CVSS: 8.8 (HIGH) \| EPSS: 0.9923 \| Used in malware: yes \| Not yet in CISA KEV: False

Correlated via CISA KEV, Shadowserver & KEVIntel.com. Source: vulnerability-lookup.org

Exploited By Ransomware Groups (2)

Ransomware Group	Vendor	Product	Source
RansomHub	Windows	SMBv1	cisa.gov
thegentlemen	MS Server Products	SMBv1	kelacyber.com

References

http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html (secure@microsoft.com)
http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html (secure@microsoft.com)
http://www.securityfocus.com/bid/96704 (secure@microsoft.com)
http://www.securitytracker.com/id/1037991 (secure@microsoft.com)
https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf (secure@microsoft.com)
https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf (secure@microsoft.com)
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 (secure@microsoft.com)
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144 (secure@microsoft.com)
https://www.exploit-db.com/exploits/41891/ (secure@microsoft.com)
https://www.exploit-db.com/exploits/41987/ (secure@microsoft.com)
https://www.exploit-db.com/exploits/42030/ (secure@microsoft.com)
https://www.exploit-db.com/exploits/42031/ (secure@microsoft.com)
http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/96704 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1037991 (af854a3a-2127-422b-91ae-364da2661108)
https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf (af854a3a-2127-422b-91ae-364da2661108)
https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf (af854a3a-2127-422b-91ae-364da2661108)
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 (af854a3a-2127-422b-91ae-364da2661108)
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144 (af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/41891/ (af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/41987/ (af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/42030/ (af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/42031/ (af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0144 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

View on CVE.org · View on NVD

CVE-2017-0144

Description

Exploitation Intelligence (3 sources)

Exploited By Ransomware Groups (2)

References