CVE-2017-0147: Microsoft Windows SMBv1 Information Disclosure Vulnerability
High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-05-24. EPSS: 99.7% chance of exploitation in the next 30 days.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."
Affected products
- Microsoft Windows 10 1507: affected versions not specified
- Microsoft Windows 10 1511: affected versions not specified
- Microsoft Windows 10 1607: affected versions not specified
- Microsoft Windows 7: affected versions not specified
- Microsoft Windows 8.1: affected versions not specified
- Microsoft Windows Rt 8.1: affected versions not specified
- Microsoft Windows Server 2008: affected versions not specified; version r2 only
- Microsoft Windows Server 2012: affected versions not specified; version r2 only
- Microsoft Windows Server 2016: affected versions not specified
- Microsoft Windows Vista: affected versions not specified
- Siemens Acuson p300 Firmware: version 13.02 only; version 13.03 only; version 13.20 only; version 13.21 only
- Siemens Acuson p500 Firmware: version va10 only; version vb10 only
- Siemens Acuson SC2000 Firmware: from 4.0, before 4.0e (fixed in 4.0e); version 5.0a only
- Siemens Acuson x700 Firmware: version 1.0 only; version 1.1 only
- Siemens Syngo SC2000 Firmware: from 4.0, before 4.0e (fixed in 4.0e); version 5.0a only
- Siemens Tissue Preparation System Firmware: any version
- Siemens Versant Kpcr Molecular System Firmware: any version
- Siemens Versant Kpcr Sample Prep Firmware: any version
Published 2017-03-17. Last modified 2026-06-17.