SLP Sliding Away With Reflection Amplification Thanks To CVE-2023-29552
Summary: CVE-2023-29552 is a high-severity flaw in the legacy Service Location Protocol that lets an unauthenticated, remote attacker register arbitrary services and launch a reflection amplification DoS attack. BitSight reported the issue in May and found it affects more than 2,000 global organizations and over 54,000 internet-accessible SLP instances, with an amplification factor as high as 2,200 times, and CISA added the CVE to its known exploited vulnerabilities catalog on November 8, 2023.
Why it matters: An amplification factor of 2,200 times means a small burst of traffic against one exposed SLP instance can turn into a flood against a victim, and the 54,000-plus exposed instances span VMware ESXi Hypervisor, Konica Minolta printers, Planex routers, IBM IMM, SMC IPMI and 665 other product types.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-29552CVE-2023-44487
- Related
- CVE-2023-29552: Service Location Protocol (SLP) Denial-of-Service Vulnerability Known Exploited Vulnerabilities · Nov 08, 2023CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability Known Exploited Vulnerabilities · Oct 10, 2023Patch Tuesday, October 2023 Edition Cyber Risks ·