Service Location Protocol (SLP) Protocol Design Flaw Reflective DDoS Amplification Vulnerability (CVE-2023-29552) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAny network devices, virtualization hosts (such as VMware ESXi), and storage systems exposed to the internet with the Service Location Protocol (SLP, RFC 2608) enabled
Unauthenticated remote attackers can leverage spoofed UDP traffic to launch massive reflective Denial-of-Service (DDoS) attacks, achieving an extreme amplification factor of up to 2,200x
Immediately block external access to SLP ports (UDP/TCP 427) or completely disable the SLP daemon in environments where it is not required
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Major vendors, including VMware and NetApp, have released security advisories and patches to address this vulnerability. For VMware ESXi environments, stopping and disabling the SLP service is the most effective mitigation.
# Stop and disable the SLP service on VMware ESXi hosts
esxcli system service stop --service=slpd
esxcli system service set --service=slpd --on-start=false2. Temporary Workaround & Hardening Configuration
If the SLP service cannot be disabled immediately, restrict access to port 427 (UDP/TCP) using firewalls or network Access Control Lists (ACLs).
# Block external SLP (Port 427) traffic using Linux iptables
iptables -A INPUT -p udp --dport 427 -j DROP
iptables -A INPUT -p tcp --dport 427 -j DROP
# Allow SLP traffic only from trusted internal subnets (e.g., 10.0.0.0/8)
iptables -I INPUT -s 10.0.0.0/8 -p udp --dport 427 -j ACCEPT3. Log Audit & IoC Verification Commands
Monitor network traffic for anomalous spikes in UDP port 427 responses and verify if the SLP service is actively listening on your local systems.
# Check if the SLP service (Port 427) is listening on the local system
netstat -anp | grep 427
# Alternative verification using the ss command
ss -lunp | grep 427Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-29552) stems from a fundamental design flaw in the Service Location Protocol (SLP, RFC 2608). SLP was designed to facilitate the discovery of shared network resources like printers and file servers within local networks. However, the protocol inherently allows unauthenticated remote attackers to register arbitrary services and lacks mechanisms to restrict response sizes. This architectural limitation enables attackers to pre-populate the SLP server with large volumes of service data, creating a highly exploitable vector for generating oversized responses.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates the exploit by registering a massive amount of dummy service URLs and attributes on an exposed SLP server (UDP port 427). Once the server's response buffer is artificially inflated, the attacker sends UDP SLP requests (such as Service or Attribute Requests) with a spoofed source IP address pointing to the victim's infrastructure. The SLP server then directs its response to the victim. Because the response contains the pre-registered large payload, the resulting traffic is amplified by hundreds to 2,200 times the size of the initial request, overwhelming the victim's network bandwidth.
3. Infrastructure & Business Impact
This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation in the wild. With an EPSS score exceeding 0.63, the likelihood of weaponization is extremely high. Since enterprise infrastructure components like VMware ESXi and NetApp storage often have SLP enabled by default, failure to restrict access can lead to severe availability degradation, potentially taking down critical business operations and external-facing services.
Official Vendor Advisories & References
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Frequently Asked SecOps Questions (CVE-2023-29552)
FAQQ1. How critical is CVE-2023-29552 and is it actively exploited in the wild?
CVE-2023-29552 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 64.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-29552?
Primary impacted vendors include ietf, vmware, netapp across service location protocol, esxi, ontap. Scope summary: All operating systems, hypervisors (including VMware ESXi), network switches, printers, and storage devices implementing SLP (RFC 2608) and exposing port 427 (UDP/TCP)
Q3. What temporary mitigations or workarounds exist for CVE-2023-29552 before patching?
[Mitigation] Immediately block external access to SLP ports (UDP/TCP 427) or completely disable the SLP daemon in environments where it is not required Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-29552
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ietf)
View Category →Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.