CVE-2023-29552: netapp smi-s provider +4 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2023-29552

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 64,0%

Kerentanan pada netapp smi-s provider, suse manager server +3 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 8 November 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

Rincian

Terbit di NVD: 25 April 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
EPSS (30 hari): 64,0% peluang dieksploitasi; lebih tinggi dari 99,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Service Location Protocol (SLP) Denial-of-Service Vulnerability
Masuk KEV: 8 November 2023
Tenggat CISA: 29 November 2023 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
netapp	smi-s provider	Semua versi
suse	manager server	Semua versi
suse	linux enterprise server	Versi 11
suse	linux enterprise server	Versi 12
suse	linux enterprise server	Versi 15
vmware	esxi	Semua versi sebelum 7.0
service location protocol project	service location protocol	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552 pemerintah AS
https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-a... advisory pihak ketiga
https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Atta... exploit · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20230426-0001/ advisory pihak ketiga
https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-proto... exploit · advisory pihak ketiga
https://www.suse.com/support/kb/doc/?id=000021051 advisory pihak ketiga
https://datatracker.ietf.org/doc/html/rfc2608 deskripsi teknis
https://github.com/curesec/slpload product

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.