Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 65.9%; technical severity is CVSS 7.5.
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Who should care
- Teams operating Service Location Protocol (SLP), Smi-s Provider, Service Location Protocol +3 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Service Location Protocol (SLP), Smi-s Provider, Service Location Protocol +3 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- VMware Security advisory CVE-2023-29552
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Verification noteAutomated link verification has not completed for this guidance yet.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CWE
- Not classified
- Affected versions
- IETF Service Location Protocol (SLP); Netapp Smi-s Provider (Version -); Service Location Protocol Project Service Location Protocol (Version -); Suse Linux Enterprise Server (Version 11 | Version 12 | Version 12 | Version 15); Suse Manager Server (Version -); VMware ESXi (End Excluding 7.0)
- Fixed versions
- VMware ESXi (Fixed from 7.0)
- Published
- 25 April 2023
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 65.9%
- Signal calculated at 79
External references
- CISA Government advisory Abuse Service Location Protocol May Lead Dos Attacks
- CISA Government advisory CVE-2023-29552
- GitHub Technical reference Slpload
- Exploit information from curesec.com
- Datatracker Ietf Technical reference Rfc2608
- Security Netapp Third-party advisory Ntap 20230426 0001
- Exploit information from www.bitsight.com