Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2017-7494 Details

Description

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: CISA-ADPCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494	CISA-ADP	US Government Resource
https://access.redhat.com/errata/RHSA-2017:1270	CVE	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1271	CVE	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1272	CVE	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1273	CVE	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1390	CVE	Third Party Advisory
https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01	CVE	Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us	CVE	Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us	CVE	Third Party Advisory
https://security.gentoo.org/glsa/201805-07	CVE	Third Party Advisory
https://security.netapp.com/advisory/ntap-20170524-0001/	CVE	Third Party Advisory
https://www.exploit-db.com/exploits/42060/	CVE	Third Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/42084/	CVE	Third Party AdvisoryVDB Entry
https://www.samba.org/samba/security/CVE-2017-7494.html	CVE	PatchVendor Advisory
http://www.debian.org/security/2017/dsa-3860	CVE	Third Party Advisory
http://www.securityfocus.com/bid/98636	CVE	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038552	CVE	Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1270	[email protected]	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1271	[email protected]	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1272	[email protected]	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1273	[email protected]	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1390	[email protected]	Third Party Advisory
https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01	[email protected]	Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us	[email protected]	Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us	[email protected]	Third Party Advisory
https://security.gentoo.org/glsa/201805-07	[email protected]	Third Party Advisory
https://security.netapp.com/advisory/ntap-20170524-0001/	[email protected]	Third Party Advisory
https://www.exploit-db.com/exploits/42060/	[email protected]	Third Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/42084/	[email protected]	Third Party AdvisoryVDB Entry
https://www.samba.org/samba/security/CVE-2017-7494.html	[email protected]	PatchVendor Advisory
http://www.debian.org/security/2017/dsa-3860	[email protected]	Third Party Advisory
http://www.securityfocus.com/bid/98636	[email protected]	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038552	[email protected]	Third Party AdvisoryVDB Entry

see all 33 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name	Date Added	Due Date	Required Action
Samba Remote Code Execution Vulnerability	Mar 30, 2023	Apr 20, 2023	Apply updates per vendor instructions.

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-94	Improper Control of Generation of Code ('Code Injection')	[email protected]
CWE-94	Improper Control of Generation of Code ('Code Injection')	CISA-ADP

Affected Products

Product	Versions
samba samba	>= 3.5.0, < 4.4.0 >= 4.4.0, < 4.4.14 >= 4.5.0, < 4.5.10 >= 4.6.0, < 4.6.4
CPE cpe:2.3:a:samba:samba:::::::: Remediation No remediation found in references.
debian debian linux	8.0
CPE cpe:2.3:o:debian:debian_linux:8.0:::::::* Remediation No remediation found in references.

Change History

24 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Apr 21, 2026	Modified Analysis	[email protected]
Oct 22, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Apr 3, 2025	Modified Analysis	[email protected]
Feb 7, 2025	CVE Modified	CISA-ADP
Jan 28, 2025	Modified Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Aug 16, 2022	Modified Analysis	[email protected]
Oct 21, 2018	CVE Modified	[email protected]
Jul 11, 2018	CVE Modified	[email protected]
Feb 24, 2018	CVE Modified	[email protected]
Jan 5, 2018	CVE Modified	[email protected]
Nov 10, 2017	CVE Modified	[email protected]
Nov 4, 2017	CVE Modified	[email protected]
Aug 13, 2017	CVE Modified	[email protected]
Jul 8, 2017	CVE Modified	[email protected]
Jun 13, 2017	CVE Modified	[email protected]
Jun 10, 2017	CVE Modified	[email protected]
Jun 9, 2017	Initial Analysis	[email protected]
Jun 1, 2017	CVE Modified	[email protected]