H3-2022-0004

Server Message Block (SMB) Port Exposed to the Internet

Category	SECURITY_MISCONFIGURATION
Base Score	3.5

Description

The SMB service is accessible from the internet.

Impact

SMB exposure has been a leading source of company breaches over the last few years. Attackers can conduct credential attacks by utilizing passwords found from past data breaches and conduct password spray attacks. If successful, this gives attackers access to the internal network. Additionally, multiple critical vulnerabilities over the years within the SMB protocol have left companies with increased risk of breach by exposing this service.

References

• The Complete Guide on Server Message Block
• Malware Spreading through SMB Brute Force Attacks
• How Threat Actors Are Using SMB Vulnerabilities