CVE-2023-29552
Service Location Protocol (SLP) Denial-of-Service Vulnerability
This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Service Location Protocol (SLP), fix it now.
CISA required action: Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
US federal civilian agencies must remediate by Nov 29, 2023.
Patch status
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.
Description
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Affected products
| Product | Vendor | Affected versions | Fixed in | Source |
|---|---|---|---|---|
| Service Location Protocol (SLP) | IETF | — | — | KEV |
| vSphere / ESXi / vCenter | VMware (Broadcom) | < 7.0 | 7.0 | NVD |
Sources: KEV = CISA Known Exploited Vulnerabilities catalog; NVD = NIST National Vulnerability Database.
Intelligence timeline
Developments from the last 30 days, newest first.
- CVSS scoredUpdateKEV
CVE-2023-29552 scored CVSS 7.5: IETF Service Location Protocol (SLP), Service Location Protocol (SLP) Denial-of-Service Vulnerability
CISA lists this as exploited in the wild. Unpatched Service Location Protocol (SLP) systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
1 earlier event is available with a subscription. See plans.
Coverage
We have not published a story about this vulnerability yet.