# CASCA evidence receipt — CVE-2017-0147 - Generation: `gen-409cbd0c74ff4feb70e4944e6b98ce40` - As known: 2026-07-21T08:13:17.697275+00:00 - Comparison: gen-56ccdaf914f7b4be95b689ccae7dc20d - Score policy: public-priority-v1.0.1 - Conflict: present ## Source assertions - **CISA-ADP** (independent_enrichment): container — CISA ADP Vulnrichment - Observed: 2026-07-19T04:27:06.398189+00:00 - Citation: https://www.cve.org/CVERecord?id=CVE-2017-0147 - **CVE** (derivative_copy): container — CVE Program Container - Observed: 2026-07-19T04:27:06.398189+00:00 - Citation: https://www.cve.org/CVERecord?id=CVE-2017-0147 - **microsoft** (original_assertion): container — The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability." - Observed: 2026-07-19T04:27:06.398189+00:00 - Citation: https://www.cve.org/CVERecord?id=CVE-2017-0147 - **CISA KEV** (original_assertion): observed_exploitation — Microsoft Windows SMBv1 Information Disclosure Vulnerability - Observed: 2026-07-19T04:54:04.25158+00:00 - Citation: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - **FIRST EPSS** (original_assertion): model_probability — Probability 0.996930000000; percentile 0.999500000000 - Observed: 2026-07-19T04:54:35.756809+00:00 - Citation: https://www.first.org/epss/data_stats.html ## CVSS assessments - **nvd@nist.gov** (Primary, CVSS 3.1): 7.5 — score eligible - Evidence class: nvd_enrichment_exact; source rank: 0 - Validation: valid_match - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` - **nvd@nist.gov** (Primary, CVSS 2.0): 4.3 — score eligible - Evidence class: nvd_enrichment_exact; source rank: 0 - Validation: valid_match - Vector: `AV:N/AC:M/Au:N/C:P/I:N/A:N` - **134c704f-9b21-4f2e-91b3-4a467353bcc0** (Secondary, CVSS 3.1): 7.5 — score eligible - Evidence class: registered_adp_or_other; source rank: 2 - Validation: valid_match - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` - **CISA-ADP** (unknown, CVSS 3.1): 7.5 — display only - Evidence class: direct_cve_record_display_only; source rank: not applicable - Validation: display-only direct record assessment - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` ## Applicability scope - **Microsoft Corporation · Windows SMB** (direct_source; unknown) - Versions: [{"status": "affected", "version": "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016"}] - **microsoft · windows_10_1507** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-9851bd571b8ab08bca589cd73710badfef557d036f0fb7707f694f1c9f597cb4` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*` - **microsoft · windows_10_1511** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-7b807aecec9e7ce1999b1cdf357022e504d2f3daa554142c46b57e2c37e3597a` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*` - **microsoft · windows_10_1607** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-740fec3e9838b5eabe76ebe27e4d0d7a4cb2e0ef7e13923300d3d0b51e3fce1c` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*` - **microsoft · windows_7** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-f20a05098a41a238f96b56b817d0482887bb39ad40620198bbe05da10ee02ffc` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*` - **microsoft · windows_8.1** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-7e46de82012029583622f69d79b86bc210b5bd25b8cb3bb4468936702b23c4b0` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*` - **microsoft · windows_rt_8.1** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-076c7e47c78d9425d54dea0b063ed7cd79e5f9f0bfdb3c9153b8aec4e71a7ad9` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*` - **microsoft · windows_server_2008** (vulnerable_target; supported) - Versions: Version not applicable; Version r2 - Canonical identity: `product-217b1ab3d25f361a639824f86753d418b35aa2a816ee370bb71b5d1dd883d87a` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*` - **microsoft · windows_server_2012** (vulnerable_target; supported) - Versions: Version not applicable; Version r2 - Canonical identity: `product-5a80416e92fed0cddbb3d4f3840218b448dee11159824ad25a0353da566963fe` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*` - **microsoft · windows_server_2016** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-02e254d111ce604757a15650ef469f4f8365d6247da82ce3ac2695c3cfc7dc5f` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*` - **microsoft · windows_vista** (vulnerable_target; supported) - Versions: Version not applicable - Canonical identity: `product-c6332934cac78bf2604a03402cb66568f867ce86c773d4333d1205e477bf93a9` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*` - **siemens · acuson_p300** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-4c9ba787c7aaf0bf6d656e50bd91ab4b6d471cd8276a05c9219202a456745193` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:siemens:acuson_p300:-:*:*:*:*:*:*:*` - **siemens · acuson_p300_firmware** (vulnerable_target; supported) - Versions: Version 13.02; Version 13.03; Version 13.20; Version 13.21 - Canonical identity: `product-c9a84d850f3cd65ee32208974be5ba2ab119c04c94fe1836a090478f967c22ba` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*` - **siemens · acuson_p500** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-ffe5768f3e88df36eb829371f695361d29483e56bf9f6a1953b4eb001de208fd` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:siemens:acuson_p500:-:*:*:*:*:*:*:*` - **siemens · acuson_p500_firmware** (vulnerable_target; supported) - Versions: Version va10; Version vb10 - Canonical identity: `product-8adff5e2d6c93d40e60981ae48dc425ecfa72c23a2a02afcc1c9e94109f3f1f6` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*` - **siemens · acuson_sc2000** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-affbf427114fff0a12fb76942085ff2e2e79e7c1e72f034d921425c4039b3465` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:siemens:acuson_sc2000:-:*:*:*:*:*:*:*` - **siemens · acuson_sc2000_firmware** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 4.0, < 4.0e); Version 5.0a - Canonical identity: `product-9c52c3e533fba2ef0acdc8a817b9278171127da563e8e48cf1cbeeeed631a3a6` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*` - **siemens · acuson_x700** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-5454ba00f1920c4535451ce05b7169083ea3970fe4f09868adbd5b4d395183ad` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:siemens:acuson_x700:-:*:*:*:*:*:*:*` - **siemens · acuson_x700_firmware** (vulnerable_target; supported) - Versions: Version 1.0; Version 1.1 - Canonical identity: `product-b4021e3bf93cc6f8e5bb6971d1f19a595cc80f381ed0d1cc7f1b75361660d90f` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*` - **siemens · syngo_sc2000** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-a4519881b173b2412eaf734830e1791cd271e3c185d801825b53d390816104bd` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:siemens:syngo_sc2000:-:*:*:*:*:*:*:*` - **siemens · syngo_sc2000_firmware** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 4.0, < 4.0e); Version 5.0a - Canonical identity: `product-4f162a216a80d74a60fcfd411f79f11ce9a2eb2c63f6728b0ae5e337a01cb8eb` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*` - **siemens · tissue_preparation_system** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-34da0e8543b492c845aba1a1ad3c8bf8ca2c177724eb896634762e2c9ced1749` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:siemens:tissue_preparation_system:-:*:*:*:*:*:*:*` - **siemens · tissue_preparation_system_firmware** (vulnerable_target; supported) - Versions: Any version (unconstrained) - Canonical identity: `product-e890847e0c8b7e1f745566a71943a2c987083b8a3907cb30acfcbdfab6352b15` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*` - **siemens · versant_kpcr_molecular_system** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-0cf8266ec67997d2ebe73e52579bbf7f45ffc855b8b0f3d1a404864dacc36a66` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:siemens:versant_kpcr_molecular_system:-:*:*:*:*:*:*:*` - **siemens · versant_kpcr_molecular_system_firmware** (vulnerable_target; supported) - Versions: Any version (unconstrained) - Canonical identity: `product-e9cf58e7692862dc0589f0ea2e8be8fdb327032f35041dabb20db2e67d509bc7` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*` - **siemens · versant_kpcr_sample_prep** (environmental_constraint; constrained) - Versions: Version not applicable - Canonical identity: `product-bded14b13a668b368023f47a8570c4c61dfeba52550e6e0ad1d2abe40536ac09` - Official link states: linked_exact - Criterion (linked_exact, environmental_constraint): `cpe:2.3:h:siemens:versant_kpcr_sample_prep:-:*:*:*:*:*:*:*` - **siemens · versant_kpcr_sample_prep_firmware** (vulnerable_target; supported) - Versions: Any version (unconstrained) - Canonical identity: `product-cb3b6a4a6e69a3518e3902504bdf624d2b194b466a6cd46812eec30a7aa64050` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*` ## Identity source boundaries - **cpe_dictionary**: 1775266 records through 2026-07-21T06:45:29.809553+00:00 - Run: `27d65b0f-b718-4b4f-bb79-c47c68d09dfa` - **cpe_match**: 643502 records through 2026-07-21T08:13:17.697275+00:00 - Run: `955dae73-7302-438b-aee1-058d7cc5d48e` ## Limitations and unknowns - KEV membership is authoritative for the catalog, not proof of exposure in any environment. - EPSS is a dated model probability and not an individual-environment prediction. - Affected or fixed status applies only to the exact cited product and version scope; unresolved scope remains unknown. - NVD-carried upstream facts remain derivative and are not independent corroboration. - Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only. - NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only. - Factor D remains unknown because WC-03 has not converted canonical CPE mappings into generation-bound mapping obligations; canonical identity alone does not score applicability. - Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred. Generated from CASCA normalized evidence. This receipt is not proof that an asset is affected, unaffected, safe, or fixed.