{"answers":{"affected":"It affects 9 products.","exploited":"Yes. Attackers have exploited CVE-2017-0144 in the wild since at least 10 Feb 2022, including in ransomware campaigns.","fix":"No fix has been published for CVE-2017-0144 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Aug 2022.","what":"CVE-2017-0144 (EternalBlue) is a high-severity memory corruption vulnerability in Microsoft Corporation Windows SMB, published on 17 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2017-0144 (EternalBlue) and fix it if it is affected.\n\nWhat it is: CVE-2017-0144 (EternalBlue) is a high-severity memory corruption vulnerability in Microsoft Corporation Windows SMB, published on 17 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: Yes. Attackers have exploited CVE-2017-0144 in the wild since at least 10 Feb 2022, including in ransomware campaigns.\n\nAffected product: Microsoft Corporation Windows SMB. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2017-0144/ (Markdown: https://insights.sbomify.com/CVE-2017-0144/index.md)","id":"CVE-2017-0144","markdown":"https://insights.sbomify.com/CVE-2017-0144/index.md","name":"CVE-2017-0144 (EternalBlue)","record":{"aliases":["GHSA-8w56-gqrj-2wfg"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Windows SMB server","requires_auth":"low_privilege","summary":"Remote attackers can execute arbitrary code on Windows systems via crafted SMBv1 packets, requiring immediate patching.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"microsoft","cpe":[{"product":"server_message_block","vendor":"microsoft"},{"product":"acuson_p300_firmware","vendor":"siemens"},{"product":"acuson_p500_firmware","vendor":"siemens"},{"product":"acuson_sc2000_firmware","vendor":"siemens"},{"product":"acuson_x700_firmware","vendor":"siemens"},{"product":"syngo_sc2000_firmware","vendor":"siemens"},{"product":"tissue_preparation_system_firmware","vendor":"siemens"},{"product":"versant_kpcr_molecular_system_firmware","vendor":"siemens"},{"product":"versant_kpcr_sample_prep_firmware","vendor":"siemens"}],"cvss":{"score":8.8,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.","ecosystems":[],"exploits":{"exploitdb":7,"first_seen":"2017-03-14","github_poc":26,"max_poc_stars":339,"metasploit":3,"nuclei":0,"refs":[{"date":"2017-07-16T19:44:04Z","kind":"github_poc","ref":"https://github.com/peterpt/eternal_scanner","stars":339,"title":"An internet scanner for exploit CVE-2017-0144 (Eternal Blue) \u0026 CVE-2017-0145 (Eternal Romance)"},{"date":"2021-03-22T09:33:51Z","kind":"github_poc","ref":"https://github.com/EEsshq/CVE-2017-0144---EtneralBlue-MS17-010-Remote-Code-Execution","stars":18,"title":null},{"date":"2025-07-10T13:46:01Z","kind":"github_poc","ref":"https://github.com/AdityaBhatt3010/VAPT-Report-on-SMB-Exploitation-in-Windows-10-Finance-Endpoint","stars":15,"title":"This report outlines a structured VAPT engagement focusing on PCI DSS compliance, SMB service enumeration, and exploitation of CVE-2017-0144 (EternalBlue) on a Windows 10 machine within a finance-oriented infrastructure."},{"date":"2024-12-30T13:28:29Z","kind":"github_poc","ref":"https://github.com/AtithKhawas/autoblue","stars":5,"title":"AutoBlue - Automated EternalBlue (CVE-2017-0144 / MS17-010) exploitation tool leveraging Nmap and Metasploit for ethical hacking, penetration testing, and CTF challenges. Strictly for authorized and educational use only!"},{"date":"2024-12-21T22:06:18Z","kind":"github_poc","ref":"https://github.com/sethwhy/BlueDoor","stars":3,"title":"Can you exploit the EternalBlue vulnerability (CVE-2017-0144) on a Windows 7 system and retrieve the hidden flag? Your goal is to gain administrative privileges and locate the flag stored behind the windows security"},{"date":"2026-06-14T15:00:15Z","kind":"github_poc","ref":"https://github.com/0xredash/CVE-2017-0144","stars":3,"title":"CVE-2017-0144"},{"date":"2019-06-02T03:41:47Z","kind":"github_poc","ref":"https://github.com/kimocoder/eternalblue","stars":1,"title":"CVE-2017-0144"},{"date":"2025-02-03T16:51:27Z","kind":"github_poc","ref":"https://github.com/MedX267/EternalBlue-Vulnerability-Scanner","stars":1,"title":"This script checks for devices vulnerable to the EternalBlue exploit (CVE-2017-0144) in a network using SMB."}],"tier":"exploited"},"has_fix":null,"headline":"Microsoft SMBv1 Remote Code Execution","id":"CVE-2017-0144","indexable":true,"kev":{"dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Known","product":"SMBv1","requiredAction":"Apply updates per vendor instructions.","vendorProject":"Microsoft","vulnerabilityName":"Microsoft SMBv1 Remote Code Execution Vulnerability"},"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2017"},"n_packages":0,"n_references":12,"next":{"headline":"Microsoft SMBv1 Remote Code Execution","id":"CVE-2017-0145"},"packages":[],"prev":{"headline":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution","id":"CVE-2017-0143"},"products":["Windows SMB"],"published":"2017-03-17","related":[{"cvss_score":8.8,"headline":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution","id":"CVE-2017-0143","kev_date_added":"2021-11-03","published":"2017-03-17"},{"cvss_score":8.8,"headline":"Microsoft SMBv1 Remote Code Execution","id":"CVE-2017-0145","kev_date_added":"2022-02-10","published":"2017-03-17"},{"cvss_score":8.8,"headline":"Microsoft Windows SMB Remote Code Execution","id":"CVE-2017-0146","kev_date_added":"2022-03-25","published":"2017-03-17"},{"cvss_score":8.1,"headline":"Microsoft SMBv1 Server Remote Code Execution","id":"CVE-2017-0148","kev_date_added":"2022-04-06","published":"2017-03-17"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-14","vendors":["Microsoft Corporation"]},"summary":"Remote attackers can execute arbitrary code on Windows systems via crafted SMBv1 packets, requiring immediate patching.","url":"https://insights.sbomify.com/CVE-2017-0144/"}