CVE-2017-0143: Microsoft Windows SMBv1 Remote Code Execution Vulnerability
What It Is — SMBv1 in Microsoft Windows contains an unspecified flaw that can be leveraged for remote code execution. The vulnerability is tracked as CVE‑2017‑0143 and was publicly disclosed in 2017.
Exploitability — The flaw is remotely exploitable over the network; proof‑of‑concept exploits have been demonstrated (e.g., WannaCry ransomware). CVSS v3.1 base score: 8.1 (High).
Affected Products — Microsoft Windows operating systems that include SMBv1 (all supported Windows Server and client versions prior to the MS17‑010 patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a patch‑management control that continuously verifies that critical OS updates are applied and documented.
- Enables organizations to produce defensible audit evidence showing remediation of high‑severity vulnerabilities, satisfying multiple framework requirements (e.g., NIST CSF, ISO 27001).
- Highlights the importance of continuous monitoring of legacy protocol usage (SMBv1) to prove due diligence to auditors and enterprise buyers.
Recommended Actions
- Deploy Microsoft’s MS17‑010 security update on all Windows assets.
- Disable SMBv1 via Group Policy or system configuration and verify the setting with automated scans.
- Update your asset inventory to flag any remaining SMBv1‑enabled hosts.
- Capture remediation evidence (patch logs, configuration snapshots) in a central Trust Center for audit readiness.
Source: CISA KEV – CVE‑2017‑0143