HIGH🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2023-29552

CVSS 7.5v3.1pub. 2023-04-25upd. 2025-10-31

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Netapp Smi S Provider
APP
Netapp
all versions
Service Location Protocol Project Service Location Protocol
APP
Service Location Protocol Project
all versions
SUSE Linux Enterprise Server
OS
Suse
111215
SUSE Manager Server
APP
Suse
all versions
VMware ESXi
OS
Vmware
< 7.0

CISA KEV — detailsi

Vendori: IETF
Producti: Service Location Protocol (SLP)
Added to KEVi: November 8, 2023
Remediation deadline (US Federal)i: November 29, 2023(overdue)

🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.

CISA descriptioni

The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.

🔴