CVE-2017-0145 is a remote code execution vulnerability in Microsoft SMBv1. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 February 2022, which means attackers have used it in real attacks. The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
What makes this SMBv1 flaw dangerous
SMBv1 is a legacy file-sharing protocol, so a remote code execution flaw in that service can turn routine network traffic into direct system compromise. In practice, that means an attacker who can reach the service may be able to execute code on the Windows host without any local interaction.
That combination is especially dangerous because SMB often sits on trusted internal networks and is exposed by inherited compatibility, not deliberate design. Once a vulnerable host is reachable, exploitation can become a fast path to full host control, followed by lateral movement, data access, or further payload delivery.
How organisations assess exposure
Exposure starts with knowing where SMBv1 still exists, which assets still listen on the relevant ports, and whether those systems are reachable from untrusted networks or other compromised segments. The most reliable starting points are asset inventory, authenticated scanning, and vendor guidance for the exact Windows versions involved.
Organisations should also check whether the vulnerability is already in active exploitation queues, because CISA’s KEV catalogue is a strong signal that patching and compensating controls should be prioritised. For version and remediation details, use the vendor advisory and the NIST National Vulnerability Database together with the CVE Program.
Remediation and compensating controls
The primary fix is to remove the vulnerable condition by applying the vendor’s remediation guidance for the affected Windows systems. Where immediate patching is not possible, organisations should reduce exposure by disabling SMBv1 where it is still enabled, restricting network reachability, and tightening segmentation around systems that must remain online.
Compensating controls matter because this class of flaw is typically exploitable over the network and can be chained with weak segmentation or broad east-west access. The goal is to make the vulnerable service unreachable except from the smallest necessary set of trusted systems.
Detection and post-compromise review
Detection should focus on unusual SMB traffic, unexpected inbound connections to file-sharing services, and signs that a host began executing processes it would not normally start in response to network activity. Once exploitation is suspected or confirmed, review the host for persistence, credential theft, and any later movement to nearby systems.
After patching, do not assume the problem is over if the service was reachable before remediation. A successful exploit can leave behind scheduled tasks, services, new accounts, dropped binaries, or stolen credentials that survive the original vulnerability fix.
Risk and Threat Considerations
This type of flaw is dangerous because it gives attackers a remote execution path into a widely trusted protocol surface. If SMBv1 remains enabled, the attacker may not need user interaction, which makes exposure more serious on systems that were left accessible for legacy compatibility.
Failure mechanism: Crafted packets are sent to the SMBv1 server, the vulnerability is triggered in the protocol handling path, and attacker-controlled code runs on the target host.
Impact: The compromise can lead to full host control, follow-on credential abuse, lateral movement, service disruption, and broader network intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | SMBv1 exploitation often leads to host access that must be constrained by strong user authentication. |
| AC-4 — Information Flow Enforcement | Network reachability is central to exploiting SMBv1, so traffic restrictions materially reduce exposure. | |
| SI-2 — Flaw Remediation | The term is an actively exploited vulnerability, making remediation discipline directly relevant. | |
| Recommendation — Enforce strong user authentication for systems exposed to legacy network services. Restrict SMB reachability with flow controls and segmented network boundaries. Prioritise remediation of the vulnerable SMBv1 condition and verify the fix. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation makes exposure discovery, prioritisation, and remediation central to this term. |
| CIS-13 — Network Monitoring and Defense | Detection of unusual SMB traffic and exploitation attempts depends on network monitoring controls. | |
| Recommendation — Continuously inventory, scan, and remediate SMBv1 exposure across the environment. Monitor SMB traffic and alert on anomalous or unauthorised file-sharing activity. | ||
Practitioner Guidance
Why practitioners should care: Treat SMBv1 RCE as a high-priority exposure whenever the protocol is still present, because the attack path can be simple, remote, and fast-moving once a host is reachable.
What to watch for: Validate that inventory, scanning, and segmentation controls all agree on where SMBv1 is still enabled, then confirm whether those assets are reachable from any path an attacker could use.
Practitioner takeaway: The most effective risk reduction is usually to eliminate SMBv1 entirely, not to rely on perimeter assumptions around a legacy service.