CVE-2017-7494

Advisory lineage Upstream: 0 Downstream: 17
Analyzed
Published: 30 May 2017, 18:00
Last modified:21 Oct 2025, 23:55

Vulnerability Summary

Overall Risk (default)
critical
90/100
CVSS Score
10 HIGH
v2.0 (nvd)
EPSS Score
94.18% CRITICAL
94% probability 0.00%
KEV
Listed
CISA
1 listing
Ransomware
Known Use
Public exploits
3 found
Dark Web
Not detected

Timeline

30 May 2017, 18:00
Published
Vulnerability first disclosed
30 Mar 2023, 00:00
Added to CISA KEV
Samba Remote Code Execution Vulnerability
20 Apr 2023, 00:00
CISA Remediation Due
Apply updates per vendor instructions.
21 Oct 2025, 23:55
Last Modified
Vulnerability information updated

Description

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 10AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 94.18%• Percentile: 100%

Techniques & Countermeasures

  • CWE-94•Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Systems

  • debian•debian_linux

    8.0

  • samba•samba

    since 3.5.0 | ≥ 3.5.0, < 4.4.0 | ≥ 4.4.0, < 4.4.14 | ≥ 4.5.0, < 4.5.10 | ≥ 4.6.0, < 4.6.4

References (17)