SLP CVE-2023-29552: 2,200x Reflective DoS Amplification
This is a protocol design flaw with no patch, and the harm falls mostly on third parties; confirm nothing on your public ranges answers on port 427, and treat any old ESXi host that does as a bigger problem than this CVE.
Must act: Anyone with SLP reachable from the internet, typically end-of-support ESXi 6.5 or 6.7 hosts, printers, server management controllers or SUSE servers running slpd on public addresses.
Can relax: Teams whose edge already blocks UDP and TCP 427, and ESXi users on supported 7.x or 8.x releases, where SLP ships disabled and firewalled.
- Scan your public address ranges for anything answering on UDP or TCP 427.
- Block UDP and TCP 427 at the internet edge and on any untrusted network segment.
- Upgrade ESXi 6.5 and 6.7 hosts to a supported release; until then disable slpd and the CIMSLP firewall ruleset per Broadcom KB 76372.