AEGLIX vulnerability intelligence
CVE-2023-29552
HIGH · CVSS 7.5 · Analyzed
Published: 2023-04-25 · Updated: 2026-06-17 · Source: NVD
Vulnerability overview
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Severity and scoring
- CVSS score
- 7.5 · HIGH
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- NVD-CWE-noinfo
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- IETF · Service Location Protocol (SLP)
- Added to catalog
- 2023-11-08
- Required action
- Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
- CISA remediation due date
- 2023-11-29
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_server:-:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:sap:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:*
cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*
Before (exclusive): 7.0
cpe:2.3:a:service_location_protocol_project:service_location_protocol:-:*:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html
Third Party Advisory
- https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html
Exploit · Third Party Advisory
- https://datatracker.ietf.org/doc/html/rfc2608
Technical Description
- https://github.com/curesec/slpload
Product
- https://security.netapp.com/advisory/ntap-20230426-0001/
Third Party Advisory
- https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
Exploit · Third Party Advisory
- https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks
Third Party Advisory · US Government Resource
- https://www.suse.com/support/kb/doc/?id=000021051
Third Party Advisory
- https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html
Third Party Advisory
- https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html
Exploit · Third Party Advisory
- https://datatracker.ietf.org/doc/html/rfc2608
Technical Description
- https://github.com/curesec/slpload
Product
- https://security.netapp.com/advisory/ntap-20230426-0001/
Third Party Advisory
- https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
Exploit · Third Party Advisory
- https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks
Third Party Advisory · US Government Resource
- https://www.suse.com/support/kb/doc/?id=000021051
Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552
US Government Resource