CVE-2017-7494

Confirmed PUBLISHED

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to...

Samba · samba

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical

At a Glance

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.

malware windows cisa metasploit ransomware

CVE Published: May 30, 2017
Exploitation Reported: Mar 30, 2023
CVSS: 9.8 Critical
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Samba	samba	since 3.5.0	Affected

CVE References

DSA-3860 debian.org · Vendor Advisory http://www.debian.org/security/2017/dsa-3860
RHSA-2017:1270 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1270
RHSA-2017:1390 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1390
RHSA-2017:1273 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1273
RHSA-2017:1271 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1271

Show 11 more references

GLSA-201805-07 security.gentoo.org · Vendor Advisory https://security.gentoo.org/glsa/201805-07
RHSA-2017:1272 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1272
42084 exploit-db.com · Exploit https://www.exploit-db.com/exploits/42084/
42060 exploit-db.com · Exploit https://www.exploit-db.com/exploits/42060/
98636 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/98636
1038552 securitytracker.com · VDB Entry http://www.securitytracker.com/id/1038552
samba.org/samba/security/CVE-2017-7494.html samba.org · CVE Record https://www.samba.org/samba/security/CVE-2017-7494.html
download.schneider-electric.com/files download.schneider-electric.com · CVE Record https://download.schneider-electric.com/files?p_enDocType=Technical+l...
h20566.www2.hpe.com/hpsc/doc/public/display h20566.www2.hpe.com · CVE Record https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&d...
security.netapp.com/advisory/ntap-20170524-0001 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20170524-0001/
h20566.www2.hpe.com/hpsc/doc/public/display h20566.www2.hpe.com · CVE Record https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&d...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2023-03-30 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/is_known_pipename.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2023-03-30 00:00:00 UTC · CISA

Used in malware

Recorded 2023-03-30 00:00:00 UTC · CISA

Proof of concept available

Recorded 2017-05-25 14:13:10 UTC · GitHub

Weaknesses (CWE)

CWE-94

Improper Control of Generation of Code ('Code Injection')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/is_known_pipename.rb	Apr 28, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

d3fudd/CVE-2017-7494_SambaCry

github · Created 2022-11-01 23:17:25 UTC · 5 stars

SambaCry (CVE-2017-7494) exploit for Samba | bind shell without Metasploit

00mjk/exploit-CVE-2017-7494

github · Created 2022-05-29 16:27:13 UTC · 1 stars

SambaCry exploit (CVE-2017-7494)

adjaliya/-CVE-2017-7494-Samba-Exploit-POC

github · Created 2021-09-29 20:31:20 UTC · 0 stars

According to researchers with Rapid7, over 110,000 devices appear on internet, which run stable Samba versions, while 92,500 seem to run unstable Samba versions, for which there is no fix. The newest Samba models, including the models 4.6.x before 4.6.4, 4.5.x before 4.5.10 and 3.5.0 before 4.4.13, was impacted by this error. May 24, 2017, Samba released version 4.6.4, which fixes a serious remote code execution vulnerability, vulnerability number CVE-2017-7494, which affected Samba 3.5.0 onwards. Vulnerability number: CVE-2017-7494 Severity Rating: High Affected software: • Samba Version < 4.6.4 • Samba Version < 4.5.10 • Samba Version < 4.4.14 Unaffected software: • Samba Version = 4.6.4 • Samba Version = 4.5.10 • Samba Version = 4.4.14

0xm4ud/noSAMBAnoCRY-CVE-2017-7494

github · Created 2021-05-09 02:32:54 UTC · 4 stars

CVE-2017-7494 python exploit

Hansindu-M/CVE-2017-7494_IT19115344

github · Created 2020-05-10 21:17:55 UTC · 0 stars

A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root.

incredible1yu/CVE-2017-7494

github · Created 2018-05-10 08:12:31 UTC · 0 stars

CVE-2017-7494 C poc

Zer0d0y/Samba-CVE-2017-7494

github · Created 2017-07-28 06:21:29 UTC · 1 stars

搭建漏洞利用测试环境

joxeankoret/CVE-2017-7494

github · Created 2017-06-05 16:25:57 UTC · 257 stars

Remote root exploit for the SAMBA CVE-2017-7494 vulnerability

opsxcq/exploit-CVE-2017-7494

github · Created 2017-05-26 00:58:25 UTC · 381 stars

SambaCry exploit and vulnerable container (CVE-2017-7494)

homjxi0e/CVE-2017-7494

github · Created 2017-05-25 14:13:10 UTC · 0 stars

is_known_pipename

metasploit · Created Unknown

Metasploit module for CVE-2017-7494

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2017-7494

{
  "cve_id": "CVE-2017-7494",
  "title": "Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable t...",
  "affected_vendor": "Samba",
  "affected_product": "samba",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2017-7494

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API