CVE-2023-29552
KEVService Location Protocol (SLP) Denial-of-Service Vulnerability
Description
The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HPublishedApr 25, 2023
Last modifiedJun 17, 2026
Added to KEVNov 8, 2023
Remediation dueNov 29, 2023
References
- blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.htmlThird Party Advisory
- curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.htmlExploitThird Party Advisory
- datatracker.ietf.org/doc/html/rfc2608Technical Description
- github.com/curesec/slploadProduct
- security.netapp.com/advisory/ntap-20230426-0001/Third Party Advisory
- bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slpExploitThird Party Advisory
- cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacksThird Party AdvisoryUS Government Resource
- suse.com/support/kb/doc/?id=000021051Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552US Government Resource
0 recent articles mention this CVE
74
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1062 days
- CVSS
- 7.5 HIGH
- EPSS (30-day exploit probability)
- 64.0% · top 1% of all CVEs
- Weakness
- NVD-CWE-noinfo
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.