Security readout for executives and security teams
Plain-English summary
CVE-2023-29552 is an SLP design/protocol issue that can let attackers abuse exposed SLP services as traffic amplifiers. The direct business impact is denial of service, not data theft. Because CISA lists it in KEV, prioritize finding and reducing exposed SLP services.
Executive priority
Treat this as urgent exposure reduction. It is not a data breach vulnerability by itself, but KEV status and amplification potential make exposed SLP a business availability risk.
Technical view
SLP allows unauthenticated remote service registration. Combined with spoofed UDP traffic, this can enable reflective denial-of-service amplification. The CVE is network reachable, low complexity, unauthenticated, and availability-impacting only, with CVSS 7.5. The provided affected-product data is non-specific.
Likely exposure
Highest exposure is any system running SLP reachable from the internet or untrusted networks. The bundle does not provide a complete product list, so inventory must be protocol- and vendor-guidance driven.
Exploitation context
CISA KEV status supports known exploitation. Public references also discuss abuse of SLP for DoS amplification. The bundle does not establish compromise of confidentiality or integrity, only availability impact through amplified traffic.
Researcher notes
Do not rely on product names alone. The CVE is protocol-centered, and affected-product metadata is incomplete. Validate SLP enablement, network reachability, and vendor-specific mitigations without performing amplification testing.
Mitigation direction
- Disable SLP where it is not operationally required.
- Block or restrict SLP from internet and untrusted networks.
- Follow affected vendor guidance for VMware, SUSE, NetApp, and other relevant platforms.
- Monitor for unexpected SLP exposure and abnormal UDP traffic patterns.
- If SLP is required, limit it to trusted management segments.
Validation and detection
- Inventory systems listening for SLP on trusted and untrusted networks.
- Check internet-facing assets for exposed SLP service.
- Review vendor advisories for each platform where SLP is enabled.
- Confirm network controls block unauthenticated external SLP access.
- Correlate DoS alerts with unusual SLP-related UDP activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-29552 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://datatracker.ietf.org/doc/html/rfc2608CVE reference
- https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slpCVE reference
- https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.htmlCVE reference
- https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacksCVE reference
- https://www.suse.com/support/kb/doc/?id=000021051CVE reference
- https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.htmlCVE reference
- https://github.com/curesec/slploadCVE reference
- https://security.netapp.com/advisory/ntap-20230426-0001/CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.