Actively exploited · Published Apr 25, 2023 · Assigned by mitre
CVE-2023-29552
High 7.5 Exploited
In plain English
A high-severity security flaw in Service Location Protocol (SLP) from IETF. Attackers are actively exploiting it in the wild (listed by CISA on November 8, 2023). The chance it is exploited in the next 30 days is estimated at 64.0% (higher than 99.2% of all known vulnerabilities). Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
CISA guidance
Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
Federal agencies must remediate by Nov 29, 2023.
Official description
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Affected products (as reported)
References
- https://datatracker.ietf.org/doc/html/rfc2608
- https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
- https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html
- https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks
- https://www.suse.com/support/kb/doc/?id=000021051
- https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html
- https://github.com/curesec/slpload
- https://security.netapp.com/advisory/ntap-20230426-0001/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552 government-resource