HIGH

CVE-2023-29552

Vmware Esxi 2023-04-25 CVSS v3.1

CVSS

7.5

KEV

Description

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

Summary dbcve.org

The Service Location Protocol (SLP, RFC 2608) contains a vulnerability allowing unauthenticated remote attackers to register arbitrary services on affected systems. Attackers can exploit this using spoofed UDP packets to conduct denial-of-service attacks with a significant amplification factor, leveraging the protocol's default UDP port 427.

Mitigation

Disable SLP on systems where it is not required, or filter UDP port 427 at network perimeter boundaries to prevent external attackers from abusing the protocol. Apply vendor patches when available.

Proof of Concept

EPSS Score

65.87%

Probability of exploitation in next 30 days

99.2th percentile

References

https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html Third Party Advisory https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html Exploit, Third Party Advisory https://datatracker.ietf.org/doc/html/rfc2608 Technical Description https://github.com/curesec/slpload Product https://security.netapp.com/advisory/ntap-20230426-0001/ Third Party Advisory https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp Exploit, Third Party Advisory https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks Third Party Advisory, US Government Resource https://www.suse.com/support/kb/doc/?id=000021051 Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE