CVE Feed

    Dashboard / CVE / CVE-2023-29552

    CVE-2023-29552

    The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

    Published:Apr 25, 2023
    Last Modified:Oct 31, 2025
    EPS:Apr 25, 2023
    EPSS Score:0.9264
    CVSS Score:7.5

    CISA Notification

    Description

    The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

    Required Action:

    Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.

    Notes:

    No extra notes provided.

    Due Date
    Nov 29, 2023
    1017 days ago
    Alert Date
    Nov 8, 2023
    1038 days ago

    Affected Products

    Vendor
    Netapp
    Product
    Smi-s Provider
    Vendor
    Service Location Protocol Project
    Product
    Service Location Protocol
    Vendor
    Suse
    Product
    Linux Enterprise Server
    Vendor
    Suse
    Product
    Manager Server
    Vendor
    Vmware
    Product
    Esxi

    Exploits

    https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.htmlhttps://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slphttps://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.htmlhttps://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2022-40304 (CVSS 7.8) — An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash ta…
    CVE-2022-2068 (CVSS 7.3) — In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where t…
    CVE-2022-1292 (CVSS 7.3) — The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script …
    CVE-2022-1434 (CVSS 5.9) — The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This m…
    CVE-2022-1343 (CVSS 5.3) — The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (n…
    CVE-2022-1473 (CVSS 7.5) — The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory oc…
    CVE-2022-29824 (CVSS 6.5) — In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't c…
    CVE-2022-23308 (CVSS 7.5) — valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.…
    CVE-2021-3541 (CVSS 6.5) — A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protectio…
    CVE-2020-15862 (CVSS 7.8) — Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides th…

    References

    https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html
    https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html
    https://datatracker.ietf.org/doc/html/rfc2608
    https://github.com/curesec/slpload
    https://security.netapp.com/advisory/ntap-20230426-0001/
    https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
    https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks
    https://www.suse.com/support/kb/doc/?id=000021051
    https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html
    https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html
    https://datatracker.ietf.org/doc/html/rfc2608
    https://github.com/curesec/slpload
    https://security.netapp.com/advisory/ntap-20230426-0001/
    https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
    https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks
    https://www.suse.com/support/kb/doc/?id=000021051
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High