SLP CVE-2023-29552: 2,200x Reflective DoS Amplification

What to do

1. Scan your public address ranges for anything answering on UDP or TCP 427.
2. Block UDP and TCP 427 at the internet edge and on any untrusted network segment.
3. Upgrade ESXi 6.5 and 6.7 hosts to a supported release; until then disable slpd and the CIMSLP firewall ruleset per Broadcom KB 76372.
4. Stop and disable slpd on Linux servers that do not need it.
5. Turn off SLP in the management settings of printers, BMCs and other appliances, and keep those interfaces off the internet.

How to check if you are affected or compromised

• Look in flow or firewall logs for large volumes of outbound UDP with source port 427, especially to many unfamiliar destinations.
• Watch for unexplained spikes in egress bandwidth from hosts that run SLP.
• On ESXi, run esxcli system slp stats get and chkconfig --list | grep slpd to see whether the daemon is running.
• If an internet-exposed ESXi 6.x host turns up, check it for compromise, since OpenSLP on these hosts has also been a ransomware entry point.

What happened#

On April 25, 2023, researchers from Bitsight and Curesec disclosed CVE-2023-29552, a design flaw in the Service Location Protocol (SLP, RFC 2608). SLP is an old discovery protocol that lets devices advertise services on a local network. It listens on UDP and TCP port 427. The CVE record says it lets an unauthenticated remote attacker register arbitrary services, then use spoofed UDP traffic for a denial-of-service attack "with a significant amplification factor." CISA published an alert the same day.

Bitsight's write-up explains the trick. An attacker first registers fake services until the server refuses more, which fills its reply buffer. The attacker then sends small Service Type Requests with the victim's address spoofed as the source. Bitsight measured a 29-byte request producing a reply of about 65,000 bytes, an amplification factor above 2,200. Normal SLP replies amplify only 1.6x to 12x. Curesec released a test tool, slpload, that measures how far a given server can be loaded.

NVD scores the bug CVSS 3.1 7.5, availability impact only. On November 8, 2023, CISA added it to the KEV catalog "based on evidence of active exploitation," with a November 29 federal deadline.

Who is affected#

Anyone running an SLP service that untrusted networks can reach. Bitsight says the flaw affects every SLP implementation it and Curesec tested. Its scans found more than 54,000 exposed SLP instances at over 2,000 organizations, across more than 670 product types. Named examples include VMware ESXi, Konica Minolta printers, Planex routers, IBM Integrated Management Module and SMC IPMI. NVD also lists SUSE Linux Enterprise Server 11, 12 and 15, SUSE Manager Server and NetApp SMI-S Provider.

For ESXi, VMware says the supported 7.x and 8.x lines are not impacted. ESXi 7.0 U2c and later and 8.0 GA and later ship with SLP disabled and filtered by the host firewall. End-of-support releases such as 6.5 and 6.7 are affected.

Do you really need to act?#

Probably not, but checking takes minutes. This bug gives nobody access to your systems. The harm lands on third parties: an exposed SLP service becomes a cannon aimed at someone else, and you pay for the bandwidth. CISA has not published the evidence behind its KEV listing. A day later, GreyNoise said the SLP scanning it saw was benign, mostly from Censys and ONYPHE. SecurityWeek noted that CISA's warning appeared to be the first report of real attacks. At disclosure, Cloudflare expected SLP attacks to rise. We found no public report of a specific attack using this CVE as of October 23, 2026.

The better reason to look is what an open port 427 says about the host. CISA's alert notes that many exposed SLP services appear to be older, likely abandoned systems. On ESXi, port 427 is also where OpenSLP had a heap overflow leading to remote code execution, CVE-2021-21974. Bitsight notes that VMware warned in February 2023 that OpenSLP was being targeted in a large ransomware campaign against internet-exposed ESXi servers. An ESXi 6.x host with SLP open to the internet needs an upgrade, not just a firewall rule.

What to do now#

1. Scan your public ranges, for example nmap -sU -sT -p U:427,T:427 <public-range>. Nothing should answer.
2. Block UDP and TCP 427 at the internet edge. Bitsight and CISA both recommend disabling SLP on untrusted networks and filtering the port where you cannot.
3. Upgrade ESXi 6.5 and 6.7 hosts to a supported release. Until then, follow Broadcom KB 76372: /etc/init.d/slpd stop, esxcli network firewall ruleset set -r CIMSLP -e 0, then chkconfig slpd off. CIM clients that find the host through SLP will stop finding it.
4. On Linux servers, check for a listener with ss -lunp | grep ':427', and stop and disable slpd if nothing needs it.
5. Turn SLP off on printers, BMCs and other appliances, and keep their management interfaces off the internet.

How to tell if you were hit#

Nobody breaks in through this bug. The question is whether your hosts were used as reflectors. Look in flow or firewall logs for heavy outbound UDP with source port 427, especially to many destinations you never talk to. Unexplained egress bandwidth spikes on SLP hosts are another sign. On ESXi, esxcli system slp stats get and chkconfig --list | grep slpd show whether the daemon is running. If you find an internet-exposed ESXi 6.x host, check it for compromise as well.

Timeline#

• Apr 25, 2023 — Bitsight and Curesec disclose CVE-2023-29552; CISA, VMware and Cloudflare publish guidance the same day.
• Nov 8, 2023 — CISA adds the CVE to KEV.
• Nov 9, 2023 — GreyNoise reports only benign SLP scanning in its sensors.
• Nov 29, 2023 — Federal remediation deadline.

Vulnerability records

• CVE-2023-29552 · KEV 2023-11-08 · The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Bitsight — New High-Severity Vulnerability (CVE-2023-29552) Discovered in the Service Location Protocol (SLP) bitsight.com
2. Curesec — slpload: SLP amplified denial-of-service verification tool github.com
3. VMware — VMware Response to CVE-2023-29552: Reflective Denial-of-Service (DoS) Amplification Vulnerability in SLP blogs.vmware.com
4. Broadcom — KB 76372: How to Disable/Enable the SLP Service on VMware ESXi knowledge.broadcom.com
5. CVE record — CVE-2023-29552 cve.org
6. NVD — CVE-2023-29552 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2023-29552 cisa.gov
8. CISA — Abuse of the Service Location Protocol May Lead to DoS Attacks (Apr 25, 2023) cisa.gov
9. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Nov 8, 2023) cisa.gov
10. CVE record — CVE-2021-21974 (OpenSLP heap overflow in ESXi) cve.org
11. Cloudflare — SLP: a new DDoS amplification vector in the wild blog.cloudflare.com
12. GreyNoise — SLP Sliding Away With Reflection/Amplification Thanks to CVE-2023-29552 greynoise.io

Coverage and analysis

1. SecurityWeek — CISA Says SLP Vulnerability Allowing Amplified DoS Attacks Exploited in the Wild securityweek.com