---
id: "CVE-2023-29552"
kind: "vulnerability"
aliases: ["CVE-2023-29552"]
title: "The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services"
severity: "high"
cvss: 7.5
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "IETF Service Location Protocol (SLP)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp smi-s provider", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "suse manager server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "suse linux enterprise server", "fixed": [], "affected": "= 11", "ecosystem": "vendor"}, {"name": "suse linux enterprise server", "fixed": [], "affected": "= 12", "ecosystem": "vendor"}, {"name": "suse linux enterprise server", "fixed": [], "affected": "= 15", "ecosystem": "vendor"}, {"name": "vmware esxi", "fixed": ["7.0"], "affected": "< 7.0", "ecosystem": "vendor"}, {"name": "service location protocol project service location protocol", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "internet-facing-hosts", "slp", "udp-427"]
not_affected_if: ["internal-only-networks", "port-427-blocked-from-untrusted-networks", "slp-not-installed"]
published_at: "2023-04-25T16:15:09+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29552", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services

The IETF Service Location Protocol (SLP) lets an unauthenticated remote attacker register services and abuse spoofed UDP traffic to run a denial-of-service attack with a large amplification factor. Attackers can use exposed SLP hosts to flood a victim with much more traffic than they send.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IETF Service Location Protocol (SLP) affected ? fixed ?
- vendor:netapp smi-s provider affected ? fixed ?
- vendor:suse manager server affected ? fixed ?
- vendor:suse linux enterprise server affected = 11 fixed ?
- vendor:suse linux enterprise server affected = 12 fixed ?
- vendor:suse linux enterprise server affected = 15 fixed ?
- vendor:vmware esxi affected < 7.0 fixed 7.0
- vendor:service location protocol project service location protocol affected ? fixed ?

## How to check

Check whether SLP is running and listening on UDP port 427 (for example: ss -lunp | grep 427 on Linux).
Check whether port 427/UDP is reachable from untrusted networks, including the internet.

## Fix

Disable the SLP service or block port 427/UDP on systems on untrusted networks, per CISA's required action.
Apply the vendor mitigations for your SLP implementation; the sources do not name a fixed version.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29552
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-29552

## From the sources

The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.

CISA required action: Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_