CVE-2017-0199
highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.995 · 100 %ileexploit · weaponizedEURUUSadded 2021-11-03remediate by 2022-05-03
required action Apply updates per vendor instructions.
EPSS · scored 2026-10-27
Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationIntelliSpace Portal 7.0.xcisa_csaf_ot
Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.
- MitigationIntelliSpace Portal 8.0.xcisa_csaf_ot
Users with questions regarding their specific ISP installations are advised by Philips to contact their local Philips service support team or their regional service support.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (24)
Public proof-of-concept and weaponised exploit code.
- exploit/windows/fileformat/office_word_htaMicrosoft Office Word Malicious Hta Executionweaponized · metasploit
- EDB-41934Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit)functional · exploit_db
- EDB-41894Microsoft Word - '.RTF' Remote Code ExecutionPoC · exploit_db
- EDB-42995Microsoft Excel - OLE Arbitrary Code ExecutionPoC · exploit_db
affected products (24)
Products and version ranges known to be affected.
- Microsoft Corporation Office/WordPad≤ Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8.1enisa_euvdEU
- microsoft windows server 2008all versionsnvdUScpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSMA-18-058-02Philips Intellispace Portal ISP Vulnerabilities2018-02-27icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to sensitive information, perform man-in-the-middle attacks, create denial of service conditions, or execute arbitrary code.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (34)
External citations — patches, advisories, analysis.
- http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.htmlcnnvd
- http://www.securitytracker.com/id/1038224cnnvd
- https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/cnnvd
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02cnnvd
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199cnnvd
- https://www.exploit-db.com/exploits/41894/cnnvd
- https://www.exploit-db.com/exploits/41934/cnnvd
- https://www.exploit-db.com/exploits/42995/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan