CVE-2017-0145: Microsoft SMBv1 Remote Code Execution Vulnerability

CVE-2017-0145 is a remote code execution vulnerability in the Microsoft SMBv1 server. It allows remote attackers to run arbitrary code by sending crafted packets to a system that still has SMBv1 enabled. Because SMBv1 is a network file-sharing protocol present on many Windows hosts, successful abuse can give an attacker a foothold on the machine without valid credentials. Public reporting links this vulnerability to ransomware campaigns, so unpatched systems remain a high-priority risk for IT and security teams.

How it works

The underlying weakness is CWE-20 (Improper Input Validation). The SMBv1 server does not adequately validate certain fields in incoming packets. An attacker who can reach the SMBv1 service over the network can craft packets that trigger the flaw and cause the server process to execute attacker-controlled code in the context of the service. No authentication is required for the initial packet exchange in the classic attack pattern for this class of SMB flaw. Exact packet structure and exploitation mechanics are not detailed here; defenders should treat any unsolicited SMBv1 traffic as suspicious and confirm technical specifics against the vendor advisory.

Am I affected? How to find it in your systems

Microsoft SMBv1 has historically shipped with multiple Windows client and server versions. It is commonly found on file servers, domain controllers, legacy workstations, and appliances that still expose SMB for compatibility. Inventory steps:

• Query systems for the SMBv1 feature or service state (PowerShell cmdlets such as Get-WindowsOptionalFeature or Get-SmbServerConfiguration, or equivalent inventory tools).
• Scan internal networks for hosts listening on TCP 445 that still negotiate SMBv1 dialects.
• Review configuration management and golden-image baselines for any remaining SMBv1 enablement.
• Confirm exact affected builds and patch levels against the Microsoft advisory for CVE-2017-0145; do not rely on version lists from secondary sources.

Telemetry signs of exploitation attempts include unusual SMBv1 negotiation traffic, crashes or restarts of the Server service, unexpected child processes spawned by system processes that handle SMB, and lateral-movement patterns immediately after SMB connections from untrusted sources. Correlate these with EDR, Windows Event Logs, and network flow data.

How to remediate

Patch first. Apply the security updates Microsoft released for this vulnerability, following the vendor’s instructions exactly. After patching:

• Disable the SMBv1 server and client components wherever they are no longer required; modern Windows environments should prefer SMBv2/SMBv3 only.
• Enforce host-based and network firewall rules that restrict SMB (TCP 445) to authorized management and file-sharing subnets.
• Verify that the update is installed across all Windows SKUs in the environment, including older or embedded variants that may still carry SMBv1.
• Re-scan to confirm SMBv1 is no longer offered and that the CVE is no longer reported by vulnerability scanners.

CISA’s required action is simply to apply updates per vendor instructions; treat that as the minimum bar.

If you can't patch immediately

Until the vendor update can be deployed, reduce exposure with compensating controls:

• Block or heavily restrict inbound TCP 445 at network boundaries and between security zones; allow SMB only from known, managed subnets.
• Disable the SMBv1 feature entirely on systems that do not need it for legacy application compatibility.
• Use intrusion-prevention or virtual-patching signatures that detect malformed SMBv1 traffic patterns associated with this class of flaw (confirm signature coverage with your vendor).
• Increase monitoring and alerting on SMB authentication failures, unusual dialect negotiations, and process-creation events tied to the SMB service.
• Segment legacy hosts that still require SMBv1 so they cannot reach high-value assets.

These measures lower likelihood and impact but do not replace the official patch.

If your data may have been exposed

Actively exploited vulnerabilities of this type are frequently used as initial access for ransomware and data theft. If you have evidence of exploitation or cannot rule it out, treat the incident as a potential breach: isolate affected hosts, preserve forensic images, reset credentials that may have been exposed, and begin containment and eradication. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether related credentials have already appeared in public dumps.