SMB NULL Session Authentication

Tenable plugin 26920 flags hosts where SMB will accept an anonymous NULL session to IPC$/named pipes such as browser or spoolss, letting an unauthenticated user pull back host, share, user, group, or password-policy data depending on the server role and policy mix. In practice this is a configuration exposure, not a normal software memory-corruption bug: Tenable maps it broadly to Windows and Samba, and Microsoft documents the behavior as legacy/conditional anonymous access controlled by RestrictNullSessAccess, anonymous pipe/share lists, and related LSA settings rather than a clean product version boundary.

Tenable's HIGH is too hot for most enterprises. The decisive friction is that successful abuse usually requires network reachability to SMB first, which in modern estates means internal access or a badly exposed 445 listener, and the direct impact is typically reconnaissance/information disclosure, not code execution. It becomes more serious on domain controllers or legacy servers where anonymous pipe access leaks domain intel that feeds password spraying and lateral movement, but that is still usually a post-initial-access amplifier, not an initial breach itself.

Why this verdict

• Requires SMB reachability first: unauthenticated remote sounds scary, but in real estates 445 is usually internal-only or segmented, which sharply reduces the reachable population.
• Implies prior foothold in many environments: if an attacker must already be on the LAN/VPN or pivoted into a server segment, the bug is no longer an initial-access problem; it is a recon booster after compromise.
• Impact is narrower than vendor CVSS suggests: the null session itself usually yields enumeration data, not direct code execution or privilege escalation. You need a second weakness to cash out that intel.
• Modern controls should break later steps: LAPS, MFA, segmentation, EDR, and spray detection all sit between anonymous enumeration and actual host takeover.
• Still worth fixing on identity infrastructure: on domain controllers or legacy member servers with permissive anonymous pipes, the leaked identity and policy data can materially improve password spraying and lateral movement.

Why not higher?

This is not a broadly reliable one-packet compromise. Real exploitation typically needs internal network access, SMB reachability, and a host role/configuration that actually returns useful anonymous data. Even after success, the attacker usually gets reconnaissance, not immediate system control.

Why not lower?

It is still unauthenticated network exposure and the tradecraft is commodity-level simple. On the wrong asset class, especially a DC or legacy server with permissive anonymous RPC exposure, the intel leak materially reduces attacker effort for the next stage.

1. Block unnecessary SMB paths — Constrain TCP/445 and 139 with host firewall and network segmentation so only approved admin, file, and application paths remain. This directly removes the attacker-position prerequisite; for a MEDIUM verdict there is no mitigation SLA, so fold this into the next hardening cycle and complete within the 365-day remediation window where cleanup is still needed.
2. Enforce anonymous-access restrictions — Set Network access: Restrict anonymous access to Named Pipes and Shares to enabled, keep Named Pipes that can be accessed anonymously empty unless there is a documented exception, and review anonymous share lists. This is the control that most directly kills the finding at its root; for MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window.
3. Audit domain controllers first — Prioritize DCs, print servers, and old application/file servers because those roles are where null-session leakage has the highest operational value to attackers. Validate whether anonymous access is truly needed before making exceptions, and complete that review within the 365-day remediation window.
4. Hunt anonymous SMB activity — Monitor for 4624 anonymous logons and 5140 access to IPC$, then correlate with repeated RPC enumeration from the same source. This will not remove the weakness, but it raises the cost of abuse while you clean up legacy access paths within the 365-day remediation window.
5. Shrink follow-on blast radius — Harden the controls that attackers use after recon: LAPS or equivalent local-admin rotation, password-spray detection, admin tiering, and SMB segmentation. These do not fix null sessions, but they blunt the payoff from the information leak while you finish remediation within the 365-day window.

Run this on the target Windows host from an elevated PowerShell session so it can read the relevant registry keys. Invoke it as powershell.exe -ExecutionPolicy Bypass -File .\check-nullsession.ps1; local administrator is recommended. This is a configuration triage check, not a live exploit test.

# check-nullsession.ps1

# Purpose: Triage whether a Windows host is likely vulnerable to SMB NULL session exposure.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-RegValue {
    param(
        [string]$Path,
        [string]$Name
    )
    try {
        $item = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Stop
        return $item.$Name
    }
    catch {
        return $null
    }
}

try {
    $lanmanPath = 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'
    $lsaPath    = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'

    $restrictNullSessAccess = Get-RegValue -Path $lanmanPath -Name 'RestrictNullSessAccess'
    $nullSessionPipes       = Get-RegValue -Path $lanmanPath -Name 'NullSessionPipes'
    $nullSessionShares      = Get-RegValue -Path $lanmanPath -Name 'NullSessionShares'
    $everyoneIncludesAnon   = Get-RegValue -Path $lsaPath    -Name 'EveryoneIncludesAnonymous'
    $restrictAnonymous      = Get-RegValue -Path $lsaPath    -Name 'RestrictAnonymous'

    $service = Get-Service -Name 'LanmanServer' -ErrorAction SilentlyContinue
    if (-not $service) {
        Write-Output 'UNKNOWN - Server service (LanmanServer) not found'
        exit 2
    }

    # Normalize multi-string values

    if ($nullSessionPipes -isnot [System.Array] -and $nullSessionPipes) {
        $nullSessionPipes = @($nullSessionPipes)
    }
    if ($nullSessionShares -isnot [System.Array] -and $nullSessionShares) {
        $nullSessionShares = @($nullSessionShares)
    }

    $reasons = @()
    $unknown = @()

    if ($restrictNullSessAccess -eq $null) {
        $unknown += 'RestrictNullSessAccess missing'
    } elseif ([int]$restrictNullSessAccess -ne 1) {
        $reasons += 'RestrictNullSessAccess is not enabled (expected 1)'
    }

    if ($nullSessionPipes -and $nullSessionPipes.Count -gt 0) {
        $reasons += ('Anonymous named pipes configured: ' + ($nullSessionPipes -join ', '))
    }

    if ($nullSessionShares -and $nullSessionShares.Count -gt 0) {
        $reasons += ('Anonymous shares configured: ' + ($nullSessionShares -join ', '))
    }

    if ($everyoneIncludesAnon -ne $null -and [int]$everyoneIncludesAnon -eq 1) {
        $reasons += 'EveryoneIncludesAnonymous is enabled'
    }

    if ($restrictAnonymous -eq $null) {
        $unknown += 'RestrictAnonymous missing'
    } elseif ([int]$restrictAnonymous -lt 1) {
        $reasons += 'RestrictAnonymous is permissive (< 1)'
    }

    if ($reasons.Count -gt 0) {
        Write-Output ('VULNERABLE - ' + ($reasons -join '; '))
        exit 1
    }

    if ($unknown.Count -gt 0) {
        Write-Output ('UNKNOWN - ' + ($unknown -join '; ') + '. No explicit insecure settings found, but the registry state is incomplete for a confident verdict.')
        exit 2
    }

    Write-Output 'PATCHED - Anonymous pipe/share access appears restricted and no permissive null-session settings were found'
    exit 0
}
catch {
    Write-Output ('UNKNOWN - ' + $_.Exception.Message)
    exit 2
}

Sources

1. Tenable Nessus Plugin 26920
2. Tenable CVE-2002-1117 record
3. NVD CVE-2002-1117
4. Microsoft Learn - IPC$ share and null session behavior in Windows
5. Microsoft Learn - Restrict anonymous access to Named Pipes and Shares
6. Microsoft Learn - Named Pipes that can be accessed anonymously
7. NetExec Wiki - Enumerate Null Sessions
8. CISA Known Exploited Vulnerabilities Catalog