CVE-2023-29552

Name: CVE-2023-29552
Creator: NVD / NIST
Published: 2023-04-25T16:15:09.537+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10Actively ExploitedEPSS 65.87%

Last modified Jun 17, 2026

CVE-2023-29552 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.. CISA has confirmed active exploitation in the wild. EPSS estimates a 65.87% chance of exploitation in the next 30 days.

Description

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

65.87%

99.2th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Nov 29, 2023.

Affected Software

Vendor	Product	Versions
Netapp	Smi-S Provider	All versions
Suse	Manager Server	All versions
Suse	Linux Enterprise Server	11
Suse	Linux Enterprise Server	12
Suse	Linux Enterprise Server	15
Vmware	Esxi	< 7.0
Service Location Protocol Project	Service Location Protocol	All versions

References

https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.htmlThird Party Advisory
https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.htmlExploit, Third Party Advisory
https://datatracker.ietf.org/doc/html/rfc2608Technical Description
https://github.com/curesec/slploadProduct
https://security.netapp.com/advisory/ntap-20230426-0001/Third Party Advisory
https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slpExploit, Third Party Advisory
https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacksThird Party Advisory, US Government Resource
https://www.suse.com/support/kb/doc/?id=000021051Third Party Advisory
https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.htmlThird Party Advisory
https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.htmlExploit, Third Party Advisory
https://datatracker.ietf.org/doc/html/rfc2608Technical Description
https://github.com/curesec/slploadProduct
https://security.netapp.com/advisory/ntap-20230426-0001/Third Party Advisory
https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slpExploit, Third Party Advisory
https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacksThird Party Advisory, US Government Resource
https://www.suse.com/support/kb/doc/?id=000021051Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552US Government Resource

Timeline

Published: Apr 25, 2023
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2023-29552?

How severe is CVE-2023-29552?

CVE-2023-29552 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 65.87% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2023-29552?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-29552?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST