VULNERABILITY INTELLIGENCE

CVE-2017-12151

CVSS score7.4 HIGH
EPSS probability4.10%
CISA KEVNot currently listed
Published2018-07-27
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.

Weakness classification

  • CWE-300: Channel Accessible by Non-Endpoint

Primary references