---
title: "SLP CVE-2023-29552: 2,200x Reflective DoS Amplification"
url: https://erroneo.us/security/briefs/slp-cve-2023-29552-reflective-dos-amplification/
description: "Internet-exposed Service Location Protocol (port 427) can be abused for 2,200x DDoS amplification. KEV since Nov 2023. Block port 427; retire ESXi 6.x."
type: security-brief
section: "Security Digest"
date_published: 2023-04-25
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-29552"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SLP CVE-2023-29552: 2,200x Reflective DoS Amplification

**Verdict: Check exposure.** This is a protocol design flaw with no patch, and the harm falls mostly on third parties; confirm nothing on your public ranges answers on port 427, and treat any old ESXi host that does as a bigger problem than this CVE.

- **Who must act:** Anyone with SLP reachable from the internet, typically end-of-support ESXi 6.5 or 6.7 hosts, printers, server management controllers or SUSE servers running slpd on public addresses.
- **Who can relax:** Teams whose edge already blocks UDP and TCP 427, and ESXi users on supported 7.x or 8.x releases, where SLP ships disabled and firewalled.
- **Affected:** Any SLP (RFC 2608) service reachable from untrusted networks; Bitsight says every implementation it tested; VMware ESXi 6.5 and 6.7 (end of general support); SUSE Linux Enterprise Server 11, 12 and 15 and SUSE Manager Server (per NVD); NetApp SMI-S Provider (per NVD); Devices Bitsight found exposing SLP, including Konica Minolta printers, Planex routers, IBM IMM and SMC IPMI
- **Fixed:** No protocol fix; mitigation is to disable SLP or filter UDP/TCP 427 on untrusted networks; VMware ESXi 7.0 U2c and later and 8.0 GA and later ship with SLP disabled and filtered
- **CVEs:** CVE-2023-29552
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Scan your public address ranges for anything answering on UDP or TCP 427.
2. Block UDP and TCP 427 at the internet edge and on any untrusted network segment.
3. Upgrade ESXi 6.5 and 6.7 hosts to a supported release; until then disable slpd and the CIMSLP firewall ruleset per Broadcom KB 76372.
4. Stop and disable slpd on Linux servers that do not need it.
5. Turn off SLP in the management settings of printers, BMCs and other appliances, and keep those interfaces off the internet.

### How to check if you are affected

- Look in flow or firewall logs for large volumes of outbound UDP with source port 427, especially to many unfamiliar destinations.
- Watch for unexplained spikes in egress bandwidth from hosts that run SLP.
- On ESXi, run esxcli system slp stats get and chkconfig --list | grep slpd to see whether the daemon is running.
- If an internet-exposed ESXi 6.x host turns up, check it for compromise, since OpenSLP on these hosts has also been a ransomware entry point.

## What happened

On April 25, 2023, researchers from Bitsight and Curesec disclosed CVE-2023-29552, a design flaw in the Service Location Protocol (SLP, RFC 2608). SLP is an old discovery protocol that lets devices advertise services on a local network. It listens on UDP and TCP port 427. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-29552) says it lets an unauthenticated remote attacker register arbitrary services, then use spoofed UDP traffic for a denial-of-service attack "with a significant amplification factor." CISA published an [alert](https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks) the same day.

[Bitsight's write-up](https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp) explains the trick. An attacker first registers fake services until the server refuses more, which fills its reply buffer. The attacker then sends small Service Type Requests with the victim's address spoofed as the source. Bitsight measured a 29-byte request producing a reply of about 65,000 bytes, an amplification factor above 2,200. Normal SLP replies amplify only 1.6x to 12x. Curesec released a test tool, [slpload](https://github.com/curesec/slpload), that measures how far a given server can be loaded.

[NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-29552) scores the bug CVSS 3.1 7.5, availability impact only. On November 8, 2023, CISA [added](https://www.cisa.gov/news-events/alerts/2023/11/08/cisa-adds-one-known-exploited-vulnerability-catalog) it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552) "based on evidence of active exploitation," with a November 29 federal deadline.

## Who is affected

Anyone running an SLP service that untrusted networks can reach. Bitsight says the flaw affects every SLP implementation it and Curesec tested. Its scans found more than 54,000 exposed SLP instances at over 2,000 organizations, across more than 670 product types. Named examples include VMware ESXi, Konica Minolta printers, Planex routers, IBM Integrated Management Module and SMC IPMI. NVD also lists SUSE Linux Enterprise Server 11, 12 and 15, SUSE Manager Server and NetApp SMI-S Provider.

For ESXi, [VMware](https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html) says the supported 7.x and 8.x lines are not impacted. ESXi 7.0 U2c and later and 8.0 GA and later ship with SLP disabled and filtered by the host firewall. End-of-support releases such as 6.5 and 6.7 are affected.

## Do you really need to act?

Probably not, but checking takes minutes. This bug gives nobody access to your systems. The harm lands on third parties: an exposed SLP service becomes a cannon aimed at someone else, and you pay for the bandwidth. CISA has not published the evidence behind its KEV listing. A day later, [GreyNoise](https://www.greynoise.io/blog/slp-sliding-away-with-reflectionamplification-thanks-to-cve-2023-29552) said the SLP scanning it saw was benign, mostly from Censys and ONYPHE. [SecurityWeek](https://www.securityweek.com/cisa-says-slp-vulnerability-allowing-amplified-dos-attacks-exploited-in-the-wild/) noted that CISA's warning appeared to be the first report of real attacks. At disclosure, [Cloudflare](https://blog.cloudflare.com/slp-new-ddos-amplification-vector/) expected SLP attacks to rise. We found no public report of a specific attack using this CVE as of October 23, 2026.

The better reason to look is what an open port 427 says about the host. CISA's alert notes that many exposed SLP services appear to be older, likely abandoned systems. On ESXi, port 427 is also where OpenSLP had a heap overflow leading to remote code execution, [CVE-2021-21974](https://www.cve.org/CVERecord?id=CVE-2021-21974). Bitsight notes that VMware warned in February 2023 that OpenSLP was being targeted in a large ransomware campaign against internet-exposed ESXi servers. An ESXi 6.x host with SLP open to the internet needs an upgrade, not just a firewall rule.

## What to do now

1. Scan your public ranges, for example `nmap -sU -sT -p U:427,T:427 <public-range>`. Nothing should answer.
2. Block UDP and TCP 427 at the internet edge. Bitsight and CISA both recommend disabling SLP on untrusted networks and filtering the port where you cannot.
3. Upgrade ESXi 6.5 and 6.7 hosts to a supported release. Until then, follow [Broadcom KB 76372](https://knowledge.broadcom.com/external/article?legacyId=76372): `/etc/init.d/slpd stop`, `esxcli network firewall ruleset set -r CIMSLP -e 0`, then `chkconfig slpd off`. CIM clients that find the host through SLP will stop finding it.
4. On Linux servers, check for a listener with `ss -lunp | grep ':427'`, and stop and disable `slpd` if nothing needs it.
5. Turn SLP off on printers, BMCs and other appliances, and keep their management interfaces off the internet.

## How to tell if you were hit

Nobody breaks in through this bug. The question is whether your hosts were used as reflectors. Look in flow or firewall logs for heavy outbound UDP with source port 427, especially to many destinations you never talk to. Unexplained egress bandwidth spikes on SLP hosts are another sign. On ESXi, `esxcli system slp stats get` and `chkconfig --list | grep slpd` show whether the daemon is running. If you find an internet-exposed ESXi 6.x host, check it for compromise as well.

## Timeline

- Apr 25, 2023 — Bitsight and Curesec disclose CVE-2023-29552; CISA, VMware and Cloudflare publish guidance the same day.
- Nov 8, 2023 — CISA adds the CVE to KEV.
- Nov 9, 2023 — GreyNoise reports only benign SLP scanning in its sensors.
- Nov 29, 2023 — Federal remediation deadline.

## Sources

1. [Bitsight — New High-Severity Vulnerability (CVE-2023-29552) Discovered in the Service Location Protocol (SLP)](https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp)
2. [Curesec — slpload: SLP amplified denial-of-service verification tool](https://github.com/curesec/slpload)
3. [VMware — VMware Response to CVE-2023-29552: Reflective Denial-of-Service (DoS) Amplification Vulnerability in SLP](https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html)
4. [Broadcom — KB 76372: How to Disable/Enable the SLP Service on VMware ESXi](https://knowledge.broadcom.com/external/article?legacyId=76372)
5. [CVE record — CVE-2023-29552](https://www.cve.org/CVERecord?id=CVE-2023-29552)
6. [NVD — CVE-2023-29552](https://nvd.nist.gov/vuln/detail/CVE-2023-29552)
7. [CISA — Known Exploited Vulnerabilities: CVE-2023-29552](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552)
8. [CISA — Abuse of the Service Location Protocol May Lead to DoS Attacks (Apr 25, 2023)](https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks)
9. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Nov 8, 2023)](https://www.cisa.gov/news-events/alerts/2023/11/08/cisa-adds-one-known-exploited-vulnerability-catalog)
10. [CVE record — CVE-2021-21974 (OpenSLP heap overflow in ESXi)](https://www.cve.org/CVERecord?id=CVE-2021-21974)
11. [Cloudflare — SLP: a new DDoS amplification vector in the wild](https://blog.cloudflare.com/slp-new-ddos-amplification-vector/)
12. [GreyNoise — SLP Sliding Away With Reflection/Amplification Thanks to CVE-2023-29552](https://www.greynoise.io/blog/slp-sliding-away-with-reflectionamplification-thanks-to-cve-2023-29552)
13. [SecurityWeek — CISA Says SLP Vulnerability Allowing Amplified DoS Attacks Exploited in the Wild](https://www.securityweek.com/cisa-says-slp-vulnerability-allowing-amplified-dos-attacks-exploited-in-the-wild/)

---
Source page: https://erroneo.us/security/briefs/slp-cve-2023-29552-reflective-dos-amplification/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt